CVE-2026-8193
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
A weakness has been identified in Akaunting 3.1.21. The component Invoice PDF Rendering in file config/dompdf.php is affected. Manipulation can lead to server-side request forgery (SSRF). The attack may be launched remotely. The exploit has been made public and could be used. The vendor did not respond.
Risk Assessment
An attacker can use SSRF to scan internal networks, access sensitive data, or launch further attacks on internal systems.
Recommendation
It is recommended to immediately isolate the system from external networks, apply temporary WAF rules to block suspicious requests, and seek an alternative solution as the vendor did not respond.
Original NVD description (English source)
A weakness has been identified in Akaunting 3.1.21. This issue affects some unknown processing of the file config/dompdf.php of the component Invoice PDF Rendering. Executing a manipulation can lead to server-side request forgery. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.