Akaunting versions prior to 2.1.31 allow an OS command injection flaw in the module installation and update flow. The alias parameter is passed without validation to a shell command, enabling an authenticated administrator to inject shell metacharacters and run arbitrary commands on the server. This vulnerability compromises confidentiality, integrity, and availability of the underlying system.

Affected software is Akaunting, all releases older than 2.1.31. The flaw resides in the core installation scripts that are executed when modules are installed or updated. Any user with authenticated admin panel access to an affected instance can trigger the vulnerability.

The CVSS score of 8.7 reflects a high‑severity risk, and the EPSS score is 2%, indicating a modest exploitation probability. The issue is not listed in the CISA Known Exploited Vulnerabilities catalog. The likely attack vector is via the web-based admin interface accessed by an authenticated user; the vulnerability requires local or web access with administrator credentials.