CVE and update status of the FreeBSD ports tree3,295 unaddressed CVEs in 670 portsAll times are CET
Port details

finance/frontaccounting 2.4.20

Simple, powerful system for the entire ERP chain

Port info

Maintainer
james@elstone.net
Packages
latest: 2.4.20
Upstream
up to date
Last update
to 2.4.20 · 7b541db13e
Quarterly
2026Q4: 2.4.20
Formerly
finance/frontaccounting24 until 2024-10-22
WWW
https://www.frontaccounting.com/
Links
cgit · VuXML · Report wrong data

Install

Package
# pkg install frontaccounting
installs 2.4.20 from latest; from quarterly (2026Q4) 2.4.20
Port
# cd /usr/ports/finance/frontaccounting && make install clean
# make -C /usr/ports/finance/frontaccounting config  # change options first
Size
1.4 MiB download · 7.1 MiB installed
Depends on
archivers/php85-zlib 8.5.12_2, converters/php85-iconv 8.5.12_2, databases/php85-mysqli 8.5.12_2, devel/gettext-runtime 1.0_1, lang/php85 8.5.12_2, textproc/php85-ctype 8.5.12_2, www/apache24 2.4.69, www/php85-session 8.5.12_2
License
GPLv3+
Options
4 of 9 on in the package: APACHE DOCS NLS REMOTE_DB
Show the 5 options that are off
LIGHTTPD MARIADB_CLIENT MYSQL_CLIENT MYSQL_SERVER NGINX
pkg-message
Shown after installing
FrontAccounting has been installed into the following directory:
 /usr/local/www/frontaccounting

 Be sure to adjust your web server's configuration to allow you to
 access that directory.

 For example create a conf file (FA.conf) in the Apache Includes 
 directory (/usr/local/etc/apache24/Includes) containing the 
 following:

        Alias /frontaccounting /usr/local/www/frontaccounting/
        <Directory /usr/local/www/frontaccounting/>
                Require all granted
                DirectoryIndex index.php
        </Directory>

        Adjust the "Require all granted" statement to suit your 
        security needs in your environment.

 Before upgrading an existing installation, back up its database,
 configuration, company directories, extensions and custom report files.
 Reconcile local changes to package-owned files before reinstalling.

 Session storage follows the PHP session.save_path configuration.
 If overriding it for this application, configure it before the session
 starts; do not enable late ini_set calls in includes/session.inc.

 An example invoice email template is installed at:
   /usr/local/www/frontaccounting/company/examples/reporting/email_template.php
 Copy it to company/<company-id>/reporting/email_template.php and customize
 the copy to enable it for that company. Back up any existing template first.
 The examples directory is not a company and is not loaded automatically.

Packages by version and architecture

latest

FreeBSD versionamd64aarch64i386
FreeBSD 162.4.202.4.20–
FreeBSD 152.4.202.4.20–
FreeBSD 142.4.202.4.202.4.20

quarterly (2026Q4)

FreeBSD versionamd64aarch64i386
FreeBSD 152.4.202.4.20–
FreeBSD 142.4.202.4.202.4.20

version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.

Unaddressed (2)

The CVE record lists the packaged version 2.4.20 as affected, and no VuXML entry names the CVE. What does this mean?

CVECVSSPublishedDescription
CVE-2026-802118.22026-08-27FrontAccounting through 2.4.20 stores and verifies user passwords as unsalted MD5 digests. admin/users.php passes md5($_POST['password']) to add_user() and update_user_p…
CVE-2026-802107.12026-08-27FrontAccounting through 2.4.20 generates a CSRF token in end_form() in includes/ui/ui_controls.inc and embeds it as the _token hidden field in every form it renders, but…

VuXML only (0)

Listed in VuXML, the packaged version 2.4.20 is still in the affected range; pkg audit reports it. What does this mean?

None.

Fixed (0)

No VuXML entries for this package.

Problem reports (0) · open in Bugzilla, most recently changed first

None.

Commits (33)

Vladimir Druzenko (vvd) · 2.4.20 MFH 2026Q3 ✓
finance/frontaccounting: Update 2.4.12 => 2.4.20

Changelog:
https://frontaccounting.com/wbt/pages/posts/release-2.4.13-230.php
https://frontaccounting.com/wbt/pages/posts/release-2.4.14-231.php
https://frontaccounting.com/wbt/pages/posts/release-2.4.15-232.php
https://frontaccounting.com/wbt/pages/posts/release-2.4.15-232.php
https://frontaccounting.com/wbt/pages/posts/release-2.4.16-233.php
https://frontaccounting.com/wbt/pages/posts/release-2.4.17-234.php
https://frontaccounting.com/wbt/pages/posts/release-2.4.18-235.php
https://frontaccounting.com/wbt/pages/posts/release-2.4.19-236.php
https://frontaccounting.com/wbt/pages/posts/release-2.4.20-237.php

- Replaced the old FreeBSD patch that enabled the late ini_set() calls.
- Upstream corrected the assignment to $deliver_to.
- Added a port patch for PDF parser and page rotation
- Add two FPDI fixes still required in upstream 2.4.20: declare
  $actual_obj and handle missing page rotation without accessing an
  array offset on false.
- Added .htaccess protection for .bak, .orig and .rej files.
- Correct the NGINX option conditional (PORT_OPTIONS:MNGINX).
- Replaced %%APACHE_VERSION%% substitutions with literal 2.4 filenames.
- Corrected the application path and session guidance; added backup
  advice.
- Remove redundant DISTNAME and DISTVERSIONSUFFIX settings.
- Regenerated all four patches using make makepatch.
- Handles empty stock-history results without PHP warnings during
  invoice/delivery voiding.
- Replaces unsupported MariaDB 10.6 with 10.11.
- Allows remote database connections without installing a local database
  client/server (Makes clear which choices install local packages.)
- Keeps mysqli unconditional and removes its duplicate conditional
  declaration.
- Fix for iconv dependency issues when sending emails.
- Use OPTIONS_SINGLE for database connectivity, requiring exactly one
  selection.
- Declare mysqli once, unconditionally.
- Replace USES+= php:cgi php:cli with USES+= php:cgi,cli. Verified that
  both arguments reach the PHP framework when no web-server option is
  selected.
- Add an optional company-specific email-template hook. Company-specific
  wording and configuration are not included
  (create company_path() . '/reporting/email_template.php).
- Replace PORTVERSION with DISTVERSION.
- Remove unnecessary MKDIR in do-install.

Retained changes include the 2.4.20 update, session and FPDI fixes, empty-stock-history handling, iconv dependency, MariaDB 10.11 and remote-database options, source-backup protection, packing-list corrections and installation guidance.

PR:		298278
Sponsored by:	UNIS Labs (vvd)
Co-authored-by:	Vladimir Druzenko <vvd@FreeBSD.org>
MFH:		2026Q3
7b541db13e
Daniel Engberg (diizzy) · 2.4.12_1
finance/frontaccounting: Change PORTNAME from frontaccounting24 to frontaccounting

..this also includes bumping PORTREVISION

Approved by:	portmgr (blanket)
5cefb10e48
Daniel Engberg (diizzy) · 2.4.12
finance/frontaccounting*: Move finance/frontaccounting24 to finance/frontaccounting

finance/frontaccounting is based on the outdated 2.3-series and is
superseded by 2.4-series. For user friendliness move the latest
version to finance/frontaccounting and retire finance/frontaccounting24
port.

PR:		281861
Reported by:	Janky Jay <ek@purplehat.org>
b14dd28e04
Muhammad Moinur Rahman (bofh) · 2.4.12 · as finance/frontaccounting24
finance/frontaccounting24: Update version 2.4.11=>2.4.12

The port has hard coded DEFAULT_VERSIONS= php=8.0 which is very much
unlikely to be. So for now update to the next version to add support for
php 8.1 and later.
This is required for the removal of php80

Approved by:	portmgr (blanket)
f7fbe95c36
Muhammad Moinur Rahman (bofh) · 2.4.11 · as finance/frontaccounting24
finance/frontaccounting24: Remove PERCONA option

Percona has removed from the tree so remove the non-default OPTION.

Approved by:	portmgr (blanket)
529bff549e
Muhammad Moinur Rahman (bofh) · 2.3.25
*/*: Remove merged or non-existent USE_PHP directives

- Remove USE_PHP=hash which is available in default php installation of
  all versions of php
  * security/pear-Horde_Crypt_Blowfish: Remove OPTION MHASH
- Remove USE_PHP=json which is available in default php installation of
  all versions of php
  * devel/pear-PHPTAL: Remove OPTION JSON
  * www/ilias: Remove OPTION SCORM2004
- Remove USE_PHP=mssql which is no longer available in php from php80
  and later and has been replaced with sqlsrv module which is Windows
  only
  * www/codeigniter: Remove OPTION MSSQL
  * www/moodle311: Remove OPTION MSSQL
  * www/moodle39: Remove OPTION MSSQL
  * www/moodle40: Remove OPTION MSSQL
  * www/moodle41: Remove OPTION MSSQL
- Remove USE_PHP=openssl which is available in default php installation
  of all versions of php
  * databases/phpmyadmin: Remove OPTION OPENSSL
  * databases/phpmyadmin5: Remove OPTION OPENSSL
  * security/pear-Horde_Crypt_Blowfish: Remove OPTION OPENSSL
  * www/nextcloud: Remove OPTION SSL
  * www/owncloud: Remove OPTION SSL
- Remove USE_PHP=pcre which is available in default php installation of
  all versions of php
  * sysutils/racktables: Remove OPTION PCRE
- Remove USE_PHP=postgresql which should be USE_PHP=pgsql and update
  following ports
  * www/typo3-11
  * www/typo3-12
- Remove USE_PHP=pdf which is no longer available as php module
  * databases/phpmyadmin: Remove OPTION PDF
- Remove USE_PHP=spl which is available in default php installation of
  all versions of php
- Remove USE_PHP=sqlsrv which was never imported into FreeBSD as that is
  Windows only php module
  * www/typo3-11: Remove OPTION SQLSRV
  * www/typo3-12: Remove OPTION SQLSRV
- Bump where DEFAULT OPTIONS are affected

Sponsored by:	Bounce Experts

Approved by:	portmgr(blanket)
0ac3a69555
Muhammad Moinur Rahman (bofh) · 2.3.25
Mk/Uses/apache.mk: Refactor after removal of older versions

apache22 and apache25 had been removed a long time ago however the
apache.mk file has never been refactored and is out of sync from the
file Mk/bsd.default-versions.mk. These changes refactors the removals of
the older versions. In addition:

- Move some keywords like USE_APACHE, USE_APACHE_BUILD, USE_APACHE_RUN
  from SANITY_DEPRECATED to SANITY_UNSUPPORTED
- Remove apache versions from ports Makefiles as currently there is only
  one available version in the tree. However the version checks are
  still valid and should work flawlessly whenever a new version is
  added. For example USES=apache:2.2+ are simply replaced with
  USES=apache. As currently there are no other versions available for
  test this could not be checked on it's own ground.
- Update FOO_USE=APACHE=yes to FOO_USES=apache
- Remove trailing whitespaces

Approved by:    portmgr
Differential Revision: https://reviews.freebsd.org/D38113
40843b1ccb
Yuri Victorovich (yuri) · 2.4.11 · as finance/frontaccounting24
finance/frontaccounting24: New port: Simple, powerful system for the entire ERP chain

PR:		262905
1b2c5cde68
Stefan Eßer (se) · 2.3.25
Remove WWW entries moved into port Makefiles

Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.

This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.

Approved by:		portmgr (tcberner)
fb16dfecae
Stefan Eßer (se) · 2.3.25
Add WWW entries to port Makefiles

It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.

Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.

There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.

This commit implements such a proposal and moves one of the WWW: entries
of each pkg-descr file into the respective port's Makefile. A heuristic
attempts to identify the most relevant URL in case there is more than
one WWW: entry in some pkg-descr file. URLs that are not moved into the
Makefile are prefixed with "See also:" instead of "WWW:" in the pkg-descr
files in order to preserve them.

There are 1256 ports that had no WWW: entries in pkg-descr files. These
ports will not be touched in this commit.

The portlint port has been adjusted to expect a WWW entry in each port
Makefile, and to flag any remaining "WWW:" lines in pkg-descr files as
deprecated.

Approved by:		portmgr (tcberner)
b7f05445c0
Tobias C. Berner (tcberner) · 2.3.25
finance: remove 'Created by' lines

A big Thank You to the original contributors of these ports:

  *  Alexey Dokuchaev <danfe@FreeBSD.org>
  *  Anton Berezin <tobez@FreeBSD.org>
  *  Christopher Boumenot <boumenot@gmail.com>
  *  David Naylor <naylor.b.david@gmail.com>
  *  Dermot Tynan <dtynan@kalopa.com>
  *  Dorit Rottner (<rottner@punkt.de>)
  *  Emanuel Haupt <ehaupt@FreeBSD.org>
  *  Eric Freeman <freebsdports@chillibear.com>
  *  Glenn Johnson <glennpj@charter.net>
  *  James FitzGibbon <jfitz@FreeBSD.org>
  *  Janky Jay <ek@purplehat.org>
  *  Mario Sergio Fujikawa Ferreira <lioux@FreeBSD.org>
  *  Maxim Sobolev <sobomax@FreeBSD.org>
  *  Michael Johnson <ahze@FreeBSD.org>
  *  Michael Reifenberger <mr@freebsd.org>
  *  Mikhail T. <m.tsatsenko@gmail.com>
  *  Mikhail Teterin
  *  Neil Booth
  *  Po-Chuan Hsieh <sunpoet@FreeBSD.org>
  *  Qian Jin <eric.siroh@gmail.com>
  *  Ryan Steinmetz <zi@FreeBSD.org>
  *  Seamus Venasse <svenasse@polaris.ca>
  *  Sergey Skvortsov <skv@protey.ru>
  *  Steven Kreuzer <skreuzer@FreeBSD.org>
  *  TAKAHASHI Kaoru <kaoru@kaisei.org>
  *  TAKATSU Tomonari <tota@FreeBSD.org>
  *  Thierry Thomas <thierry@pompo.net>
  *  Thomas Gellekum <tg@FreeBSD.org>
  *  Trevor Caira <trevor@bitba.se>
  *  Vick Khera <vivek@khera.org>
  *  Vivek Khera <vivek@khera.org>
  *  Wen Heping <wen@FreeBSD.org>
  *  Wen heping <wenheping@gmail.com>
  *  Yen-Ming Lee <leeym@FreeBSD.org>
  *  Yuri Victorovich <yuri@rawbw.com>
  *  Zach Thompson <hideo@lastamericanempire.com>
  *  anarcat@anarcat.ath.cx
  *  chinsan
  *  courou <courou@users.sourceforge.net>
  *  ijliao
  *  lth@FreeBSD.org
  *  wcarey
  *  will

With hat:	portmgr
302a0617cc
Mathieu Arnold (mat) · 2.3.25
all: Remove all other $FreeBSD keywords.
135fdeebb9
Mathieu Arnold (mat) · 2.3.25
Remove # $FreeBSD$ from Makefiles.
305f148f48
Dmitry Marakasov (amdmi3) · 2.3.25
- Fix LICENSE - Update WWW

Approved by:	portmgr blanket
ba0ff8ca9d
Tobias Kortkamp (tobik) · 2.3.25
Add more missing USES=php
6bc0e0420c
Tobias Kortkamp (tobik) · 2.3.25
Move remaining USE_MYSQL, WANT_MYSQL_VER to USES=mysql
581cac9416
Mathieu Arnold (mat) · 2.3.25
Convert to UCL & cleanup pkg-message (categories e-g)
79698c8457
Bernard Spil (brnrd) · 2.3.25
nce/frontaccounting: Convert to USES=php

Approved by:    infrastructure modernization blanket
edc41da735
Mathieu Arnold (mat) · 2.3.25
Remove ${PORTSDIR}/ from dependencies, categories d, e, f, and g.

With hat:	portmgr
Sponsored by:	Absolight
4e1b79a0a6
Raphael Kubo da Costa (rakuco) · 2.3.25
Update to 2.3.25.

PR:		207427
Submitted by:	ek@purplehat.org (maintainer)
e1c53f2b7a
Martin Wilke (miwi) · 2.3.24_1
- Use mysqli only
ed267c9016
John Marino (marino) · 2.3.24
finance/frontaccounting: Upgrade version 2.3.22 => 2.3.24

The version update was done because the port had to address missing PHP
modules anyway.  Why here:

 * Add the missing hash, ctype, zlib modules
 * leverage new options framework to simply options handling
 * implement NLS option (was listed, but not implemented)
 * explicitly list DOCS option (implemented but unselectable)
 * Rename MYSQL option to MYSQL_SERVER because MySQL client is
   installed unconditionally so the option name was misleading
 * Unsuppress install commands
 * Wrap compound commands in parentheses for multijob support
 * Wrap to 80 columns
 * Remove bogus post-install cat pkgmessage target
 * Remove 120 bogus @dir lines introduced in [2]

PR:		200265
PR:		194255 [2]
Reported by:	marino
Initial fix:	maintainer (ek - purplehat.org)
rest of fixes:	marino
c8ce88087d
Dmitry Marakasov (amdmi3) · 2.3.22
- Simplify MASTER_SITES - Add CPE info

Approved by:	portmgr blanket
e653dd91d9
Alex Dupre (ale) · 2.3.22
Properly depend on mysql server.
dbfdaa09ec
Johannes Jost Meixner (xmj) · 2.3.22
finance/frontaccounting: upgrade to 2.3.22

- Upgrade to 2.3.22
- Depend on Apache 2.2 or later.
- Add dependency on mod_php5 or CGI when used with Apache
- Add NLS option
- (re-)assign maintainer to ek@purplehat.org

PR:		194255
Differential Revision:	https://reviews.freebsd.org/D964
Submitted by:	ek@purplehat.org
Approved by:	swills (mentor)
fe103bfd33
Thomas Zander (riggs) · 2.3.21
- Update to upstream version 2.3.21 - Stagify - Handle file ownerships via plist macros

PR:		192602
Submitted by:	Janky@purplehat.org
Approved by:	mentors (implicit)
5fb093f64e
Baptiste Daroussin (bapt) · 2.3.15
Reset maintainership for ports not staged with no pending PR

With hat:	portmgr
64620e9118
Baptiste Daroussin (bapt) · 2.3.15
Add NO_STAGE all over the place in preparation for the staging support (cat: finance)
1c7169ab74
Alex Kozlov (ak) · 2.3.15
- Convert USE_GETTEXT to USES (part 3)

Approved by:	portmgr (bapt)
e159824929
Alexey Dokuchaev (danfe) · 2.3.15
In categories starting with [efg], remove empty lines from pkg-plist (except for `graphics/kipi-plugins').
d6fe06e31d
Beech Rintoul (beech) · 2.3.15
- Update to 2.3.15 - Update License

PR:		ports/176761
Submitted by:	Janketh Jay <ek@purplehat.org> (maintainer)
d676e8607f
Ruslan Makhmatkhanov (rm) · 2.3.14
- update to 2.3.14

while here:
- trim Makefile header
- add missing file to pkg-plist
- remove bogus PORTDOCS variable - it's not used anyhow in the port itself for
  docs installing (it's handled manually), but setting PORTDOCS implies removin
  ${PREFIX}/share/doc/${PORTNAME} directory at deinstall that the port do not
  creates in first place, producing warning about that
- tweak the docs path in PORTDOCSARGS
- remove trailing whitespace in pkg-descr

PR:		175444
Submitted by:	Janketh Jay <ek@purplehat.org> (maintainer)
bb6315a633
Chris Rees (crees) · 2.3.13
FrontAccounting is a simple, but powerful, system for the entire ERP chain and covers:

Purchase Orders
Goods Receivable Notes
Supplier Invoices/Credit Notes
Payments
Allocations
Accounts Payable
Items and Inventory
Stock
Manufacturing
Sales Orders
Customer Invoices/Credit Notes
Deposits
Allocations
Accounts Receivable
Among many others...

FrontAccounting is free and released under the GNU General
Public License.

WWW: http://www.frontaccounting.com/

PR:		ports/174601
Submitted by:	Janky Jay <ek@purplehat.org>
0460b5a6c1