CVE-2024-22836

9.8 criticalEPSS 30%

Critical (9.8) in akaunting akaunting. EPSS 30% chance of exploitation in the next 30 days.

An OS command injection vulnerability exists in Akaunting v3.1.3 and earlier. An attacker can manipulate the company locale when installing an app to execute system commands on the hosting server.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 30% chance of exploitation in the next 30 days; higher than 98% of CVEs (scores of 2026-10-31)
CWE: CWE-78
Published: 2024-02-08
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

akaunting:akaunting

References

https://akaunting.com/
https://github.com/akaunting/akaunting/releases/tag/3.1.4
https://github.com/u32i/cve/tree/main/CVE-2024-22836
https://akaunting.com/
https://github.com/akaunting/akaunting/releases/tag/3.1.4

Check your stack JSON