What this actually is.
Technical background, root cause, and affected surface.
A bitwise OR operator (|) is used where a logical OR (||) was intended in an input validation check. This causes the sanitization condition to always evaluate to a non-zero (truthy) value regardless of input, effectively disabling the shell metacharacter filter.
- Vendor
- Netatalk
- Product
- Netatalk
- Severity
- High
- CVSS Score
- 7.5
- Status
- Published
- CWE
- CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
- Vector
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
From one request
to root shell.
Reproduced in a sandboxed environment. Requires only LAN or WiFi adjacency.
The bug, and the fix.
afpd/volume.c or afpd/unix.c: shell metacharacter check uses (char_a | char_b) instead of (char_a || char_b), defeating the filter
Root cause: Typo: bitwise OR (|) used instead of logical OR (||) in security-sensitive input validation condition
When does this fire?
All conditions must be true for the exploit to succeed.
Authenticated AFP client with volume configuration access supplies shell metacharacters in a field that is passed to system()/popen()
What an attacker does to you.
Post-exploitation outcomes mapped to CVSS impact metrics.
Arbitrary OS command execution with the privileges of the afpd daemon (root)
Fix it. In this order.
A runbook, not a checklist. Sequence matters — assume compromise before you act.
Upgrade to Netatalk 4.4.3 which corrects the operator and properly validates shell metacharacters.
disclose@securin.ioVendors moved in days.
Attackers in hours.
Reconstructed from vendor advisories, CISA bulletins, and Securin research records.
2026-05-13: Netatalk 4.4.3 patch released | 2026-05-21: CVE published to MITRE
Timeline recorded · Disclosure coordinated by Securin
Cite, verify, go deeper.
Primary sources — NVD, CISA KEV, and machine-readable IoC feed.