CVE-2022-51019

Name of the Vulnerable Software and Affected Versions Akaunting versions prior to 2.1.31

Description An OS command injection issue exists in the module installation and update flow. Authenticated users with admin panel access can execute arbitrary commands on the server by injecting shell metacharacters into the alias parameter, which is passed unvalidated to shell command execution.

Recommendations Update to version 2.1.31 or later. Avoid using the alias parameter during module installation or updates until the system is updated.