Is there a public PoC exploit available for CVE-2026-8193?

Yes, a public proof-of-concept exploit is available for CVE-2026-8193. Prioritise patching immediately. EPSS: 0.0%.

Akaunting CVE-2026-8193

Q: What is the CVSS score of CVE-2026-8193?

CVE-2026-8193 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-28921 LOW

Server-Side Request Forgery (SSRF) (CWE-918)

2026-05-09 VulDB

SSRF PHP

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 09, 2026 - 19:30 vuln.today

Severity Changed

May 09, 2026 - 19:22 NVD

MEDIUM LOW

CVSS changed

May 09, 2026 - 19:22 NVD

6.3 (MEDIUM) 2.1 (LOW)

CVE Published

May 09, 2026 - 18:45 nvd

LOW 2.1

DescriptionCVE.org

A weakness has been identified in Akaunting 3.1.21. This issue affects some unknown processing of the file config/dompdf.php of the component Invoice PDF Rendering. Executing a manipulation can lead to server-side request forgery. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Server-side request forgery in Akaunting 3.1.21 allows authenticated attackers to manipulate the Invoice PDF Rendering component via the config/dompdf.php file, enabling arbitrary HTTP requests from the server to internal or external systems. The vulnerability has CVSS score 2.1 with low severity impact across confidentiality, integrity, and availability; however, publicly available exploit code exists and the vendor did not respond to early disclosure, increasing real-world exploitation risk despite low CVSS metrics.

Technical ContextAI

Akaunting's Invoice PDF Rendering functionality processes user input through the dompdf.php configuration file without adequate validation or sanitization of request parameters. The underlying weakness is classified as CWE-918 (Server-Side Request Forgery), which occurs when an application fetches remote resources based on user-supplied input without proper verification of the destination. The dompdf library is a popular PHP-based PDF renderer that can be configured to load resources (images, stylesheets, fonts) from URLs; if the configuration allows user-controlled URL parameters to be passed directly to network functions, attackers can pivot from the application server to access internal services, local file systems, or cloud metadata endpoints that are otherwise unreachable from the attacker's network.

RemediationAI

No vendor-released patch identified at time of analysis - the vendor did not respond to early disclosure efforts. Immediate mitigation requires upgrading to a version newer than 3.1.21 if available from the Akaunting project, or implementing network-level compensating controls. Specific actions: (1) Restrict outbound network access from the Akaunting application server using firewall rules or security group policies to block HTTP/HTTPS requests to internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and cloud metadata endpoints (169.254.169.254 for AWS, GCP metadata services) - trade-off: may break legitimate functionality if the application intentionally fetches remote resources; (2) Disable or remove the Invoice PDF Rendering feature if not actively used, preventing the attack surface from being reachable; (3) Implement rate limiting and request logging on PDF generation endpoints to detect and alert on anomalous resource fetches; (4) Run Akaunting in a containerized environment with strict network policies that isolate the application from internal services. Check VulDB reference (https://vuldb.com/vuln/362345) for any vendor response updates. If the vendor remains unresponsive, consider migrating to an actively maintained invoicing platform with security-conscious development practices.