Vulnerability · Published Dec 11, 2025 · Assigned by VulnCheck
CVE-2024-58293Akaunting 3.1.8 Server-Side Template Injection via Multiple Form Fields
High 8.6
In plain English
A high-severity security flaw in Akaunting from Akaunting. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities).
Severity (CVSS 4.0)8.6High
Exploit odds (30 days)0.4%top 70.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Akaunting 3.1.8 contains a server-side template injection vulnerability that allows authenticated administrators to execute template expressions in multiple form input fields. Attackers can inject template payloads in items, taxes, transactions, and vendor name fields to perform arithmetic operations and string manipulations.
Affected products (as reported)
Weakness: CWE-1336 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References
- ExploitDB-52030 exploit
- Vendor Homepage product
- Software Link product
- VulnCheck Advisory: Akaunting 3.1.8 Server-Side Template Injection via Multiple Form Fields third-party-advisory