Critical severity9.8NVD Advisory· Published Feb 8, 2024· Updated Jun 17, 2026

CVE-2024-22836

Description

An OS command injection vulnerability exists in Akaunting v3.1.3 and earlier. An attacker can manipulate the company locale when installing an app to execute system commands on the hosting server.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Akaunting/Akaunting3 versions
cpe:2.3:a:akaunting:akaunting:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:akaunting:akaunting:*:*:*:*:*:*:*:*range: <3.1.4
- (no CPE)
- (no CPE)range: <=3.1.3

Patches

Vulnerability mechanics

References

github.com/u32i/cve/tree/main/CVE-2024-22836nvdThird Party Advisory
akaunting.comnvdProduct
github.com/akaunting/akaunting/releases/tag/3.1.4nvdRelease Notes

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.024
exploit	0.030
kev	0.000
patch	0.000
ransomware	0.000