CVE-2026-8193 — Some Unknown Processing Of The File Config/Dompdf.Php Of The Server-Side Request Forgery

title: SSRF via Dompdf.php in Akaunting Invoice PDF Rendering — CVE-2026-8193
id: scw-2026-05-09-ai-1
status: experimental
level: high
description: |
  Detects attempts to exploit CVE-2026-8193 by targeting the dompdf.php file with a 'url=' parameter, indicative of a Server-Side Request Forgery (SSRF) attack within Akaunting's invoice PDF rendering component. This rule specifically looks for the vulnerable file path and a common SSRF parameter.
author: SCW Feed Engine (AI-generated)
date: 2026-05-09
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-8193/
tags:
  - attack.initial_access
  - attack.t1190
logsource:
    category: webserver
detection:
  selection:
      cs-uri: 
          - '/config/dompdf.php'
      cs-method: 
          - 'GET'
      cs-uri-query|contains:
          - 'url=' 
  condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse