The papd daemon in Netatalk before 2.0.4-beta2 when using certain variables in a pipe command for the print file allows remote attackers to execute arbitrary commands via shell metacharacters in a print request as demonstrated using a crafted Title.