Executive brief
A security vulnerability exists in Akaunting, an open-source accounting software used by small businesses to manage finances and invoices. An attacker can exploit the invoice generation system to perform a server-side request forgery (SSRF) attack. This could allow an unauthorized user to probe internal network resources or access sensitive data that is not intended to be public. A public exploit is available, and the vendor has not yet released a fix.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in Akaunting 3.1.21 within the Invoice PDF Rendering component. The issue stems from improper handling of input processed by the dompdf library, specifically involving the 'config/dompdf.php' file. A remote attacker with low-level privileges can manipulate invoice data (such as unsanitized notes containing HTML) to force the server to make unauthorized requests to internal or external resources. This can lead to internal port scanning or information disclosure. A public proof-of-concept exploit has been released, and as of the advisory date, the vendor has not responded to disclosure attempts.
Affected products
- Akaunting Akaunting 3.1.21
Timeline
- 2026-05-09: disclosed: Initial disclosure and NVD publication
- 2026-05-09: other: Public exploit made available