HIGH
Akaunting 3.1.8 Server-Side Template Injection via Multiple Form Fields
Published Dec 11, 2025
8.6
HIGHCVSS 4.0
EPSS 0.35%
Description
Akaunting 3.1.8 contains a server-side template injection vulnerability that allows authenticated administrators to execute template expressions in multiple form input fields. Attackers can inject template payloads in items, taxes, transactions, and vendor name fields to perform arithmetic operations and string manipulations.
Affected products
-
- Version 3.1.8StatusaffectedConstraints-
- Version
No data.
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Weaknesses (1)
References (5)
- https://akaunting.com/forum product
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-55338 Advisory
- https://www.exploit-db.com/exploits/52030 exploit
- https://www.softaculous.com/apps/erp/Akaunting product
- https://www.vulncheck.com/advisories/akaunting-server-side-template-injection-via-multiple-form-fields third-party-advisory
| Link | Providers | Tags |
|---|---|---|
| https://akaunting.com/forum | product | |
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-55338 | Advisory | |
| https://www.exploit-db.com/exploits/52030 | exploit | |
| https://www.softaculous.com/apps/erp/Akaunting | product | |
| https://www.vulncheck.com/advisories/akaunting-server-side-template-injection-via-multiple-form-fields | third-party-advisory |
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner VulnCheck
Published Dec 11, 2025
Updated Apr 7, 2026
Reserved Dec 11, 2025
Link CVE-2024-58293
CISA Vulnrichment
Updated Dec 16, 2025
ENISA EUVD
EUVD-2024-55338 Assigner VulnCheck
Published Dec 11, 2025
Updated Apr 7, 2026
Exploited since n/a
Link EUVD-2024-55338