CVE-2022-51019

8.8 HIGHpublic exploit available

Published 2026-09-29 · Updated 2026-09-29

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

Akaunting before 2.1.31 contains an OS command injection vulnerability in the module installation and update flow where the alias parameter is passed unvalidated to shell command execution. Authenticated users with admin panel access can inject shell metacharacters into the alias parameter to execute arbitrary commands on the server.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-78

Public exploit & PoC references

https://github.com/akaunting/akaunting
https://github.com/akaunting/akaunting/blob/2.1.30/app/Jobs/Install/FinishUpdate.php#L45-L47
https://github.com/akaunting/akaunting/blob/2.1.30/app/Jobs/Install/InstallModule.php#L37-L39
https://github.com/akaunting/akaunting/commit/a1792327347a56ea575240b58673b2ece44230da
https://github.com/akaunting/akaunting/releases/tag/2.1.31

All references

https://github.com/akaunting/akaunting
https://github.com/akaunting/akaunting/blob/2.1.30/app/Jobs/Install/FinishUpdate.php#L45-L47
https://github.com/akaunting/akaunting/blob/2.1.30/app/Jobs/Install/InstallModule.php#L37-L39
https://github.com/akaunting/akaunting/commit/a1792327347a56ea575240b58673b2ece44230da
https://github.com/akaunting/akaunting/releases/tag/2.1.31
https://www.vulncheck.com/advisories/akaunting-before-2.1.31-os-command-injection-via-app-alias

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

HIGHCVE-2025-14754
HIGHCVE-2026-100292
HIGHCVE-2026-100368PoC
UNSCOREDCVE-2026-100382
HIGHCVE-2026-100559PoC
HIGHCVE-2026-100599PoC
HIGHCVE-2026-100844PoC
HIGHCVE-2026-100852PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.