CVE-2024-58293
Akaunting 3.1.8 Server-Side Template Injection via Multiple Form Fields
- State
- Published
- Severity
- 8.6 High
- Published
- Dec 11, 2025
- Updated
- Apr 7, 2026
- Reserved
- Dec 11, 2025
Description
Akaunting 3.1.8 contains a server-side template injection vulnerability that allows authenticated administrators to execute template expressions in multiple form input fields. Attackers can inject template payloads in items, taxes, transactions, and vendor name fields to perform arithmetic operations and string manipulations.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.6 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
Weaknesses
- CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine
Affected Products
| Product | Versions |
|---|---|
AkauntingAkaunting |
|
References
- ExploitDB-52030exploit
- Vendor Homepageproduct
- Software Linkproduct
- VulnCheck Advisory: Akaunting 3.1.8 Server-Side Template Injection via Multiple Form Fieldsthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.