OS Command Injection Vulnerability in Akaunting by Akaunting
CVE-2022-51019

8.7HIGH

Key Information:

Vendor

Akaunting

Status
Akaunting
Vendor
CVE Published:
29 September 2026

What is CVE-2022-51019?

A vulnerability exists in Akaunting prior to version 2.1.31, where an OS command injection issue in the module installation and update flow allows authenticated users with access to the admin panel to manipulate the alias parameter. By injecting shell metacharacters, these users can execute arbitrary commands on the server, leading to potential unauthorized access and security breaches.

Affected Version(s)

akaunting 0 < 2.1.31

References

https://github.com/akaunting/akaunting/commit/a1792327347...
patch
https://github.com/akaunting/akaunting/releases/tag/2.1.31
release-notes
https://github.com/akaunting/akaunting/blob/2.1.30/app/Jo...
technical-description

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Yunus Aydın
.