CVE-2022-51019: Akaunting before 2.1.31 OS Command Injection via app alias

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-29 · updated 2026-09-29
Weakness: CWE-78

Description

Akaunting before 2.1.31 contains an OS command injection vulnerability in the module installation and update flow where the alias parameter is passed unvalidated to shell command execution. Authenticated users with admin panel access can inject shell metacharacters into the alias parameter to execute arbitrary commands on the server.

Affected products

Akaunting: before 2.1.31 — fixed in 2.1.31

How to fix

Upgrade to a fixed version: Akaunting 2.1.31. Check the vendor advisory for mitigations.

References

https://github.com/akaunting/akaunting
https://github.com/akaunting/akaunting/blob/2.1.30/app/Jobs/Install/FinishUpdate.php#L45-L47
https://github.com/akaunting/akaunting/blob/2.1.30/app/Jobs/Install/InstallModule.php#L37-L39
https://github.com/akaunting/akaunting/commit/a1792327347a56ea575240b58673b2ece44230da
https://github.com/akaunting/akaunting/releases/tag/2.1.31
https://www.vulncheck.com/advisories/akaunting-before-2.1.31-os-command-injection-via-app-alias

Get alerted when CVE-2022-51019 or the next vulnerability affects your stack