CVE-2026-44076 — In Netatalk 3.1.0 through 4.4.2, shell injection via volume

title: CVE-2026-44076 - Netatalk Shell Injection via Volume Path
id: scw-2026-05-21-ai-1
status: experimental
level: critical
description: |
  Detects the exploitation of CVE-2026-44076 in Netatalk versions 3.1.0 through 4.4.2. This rule specifically looks for the netatalk binary being executed with command line arguments that indicate shell injection attempts within the volume path, such as using backticks for command substitution.
author: SCW Feed Engine (AI-generated)
date: 2026-05-21
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-44076/
tags:
  - attack.execution
  - attack.t1059.004
logsource:
    category: process_creation
detection:
  selection:
      Image|endswith:
          - '/usr/sbin/netatalk'
      CommandLine|contains:
          - 'touch /tmp/`'
          - 'echo `'
      condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse