CVE-2024-58293 - CVE House
Back to Database
Status published High CVE-2024-58293

Akaunting 3.1.8 Server-Side Template Injection via Multiple Form Fields

Vulnerability Description

Akaunting 3.1.8 contains a server-side template injection vulnerability that allows authenticated administrators to execute template expressions in multiple form input fields. Attackers can inject template payloads in items, taxes, transactions, and vendor name fields to perform arithmetic operations and string manipulations.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-58293

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • tmrswrr

References

More from Akaunting

View All →
CVE-2021-36805
Akaunting Invoice Footer Persistent XSS
Medium 5.2
CVE-2021-36804
Akaunting Password Reset Relay
Medium 5.4
CVE-2021-36803
Akaunting Avatar Persistent XSS
Medium 6.3
CVE-2021-36802
Akaunting DoS via User-Controlled 'locale' Variable
Medium 6.5
CVE-2021-36801
Akaunting Authentication Bypass in Company Selection
High 8.1

Affected Vendor

Affected Software

Akaunting
Vulnerable Versions:
3.1.8

Timeline

Official Publish: December 11th, 2025
Last Modified: April 7th, 2026
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-1336

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.