A vulnerability in the Invoice PDF Rendering component of Akaunting, specifically in config/dompdf.php, allows an attacker to perform a server‑side request forgery. A crafted request can cause the server to make unintended outbound connections to arbitrary URLs. This flaw can be exploited from outside the application, enabling remote attackers to trigger these forged requests. The exploit code has been publicly released and is actively available.

The issue affects Akaunting e‑commerce and accounting software, specifically version 3.1.21. No other versions are listed as impacted. Users running this version should verify their installation and check for a newer release that addresses the problem.

The CVSS score of 5.3 reflects medium severity, and the EPSS score is not available, suggesting that the risk of exploitation at this time is unclear but potentially moderate. The vulnerability is not listed in CISA’s KEV catalog. Given the remote nature of the attack vector and the public availability of the exploit, the risk remains significant for systems that expose the vulnerable PHP file to external traffic. An attacker can potentially cause arbitrary outbound traffic, leading to data leakage or further compromise of external systems.