{"affected":[{"defaultStatus":"affected","platforms":["Windows","MacOS","Linux"],"product":"Akaunting","source":"CNA: Fluid Attacks","vendor":"Akaunting","versions":[{"status":"affected","version":"3.3.0","versionType":"semver"}]}],"cveId":"CVE-2026-118597","cwes":["CWE-79"],"description":"Akaunting 3.3.0 contains a stored cross-site scripting vulnerability in custom invoice payment terms. An authenticated Manager can save a crafted custom payment-term value. When an authorized user opens Invoice Settings for the same company, Akaunting inserts the stored value into a client-side event-handler expression, causing attacker-controlled JavaScript to execute in the victim's authenticated origin.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":7.2,"severity":"high","source":"CNA: Fluid Attacks","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N","version":"4.0"}],"modifiedAt":1794463774999,"publishedAt":1794463774999,"references":[{"source":"CNA: Fluid Attacks","tags":["third-party-advisory"],"url":"https://fluidattacks.com/advisories/rhiannon"},{"source":"CNA: Fluid Attacks","tags":["product"],"url":"https://github.com/akaunting/akaunting"},{"source":"CNA: Fluid Attacks","tags":["technical-description"],"url":"https://github.com/akaunting/akaunting/blob/3.3.0/app/View/Components/Form/Group/PaymentTerm.php"},{"source":"CNA: Fluid Attacks","tags":["technical-description"],"url":"https://github.com/akaunting/akaunting/blob/3.3.0/resources/views/components/form/group/payment_term.blade.php"},{"source":"CNA: Fluid Attacks","tags":["technical-description"],"url":"https://github.com/akaunting/akaunting/blob/3.3.0/app/Abstracts/Http/SettingController.php"}],"remediation":[{"kind":"fix","source":"CNA: Fluid Attacks","text":"Use a JavaScript-safe serializer such as Laravel Js::from() or a framework data binding for the custom payment-term value; validate it as a bounded integer when it represents a number of days; apply the vendor-fixed release once one is published."},{"kind":"workaround","source":"CNA: Fluid Attacks","text":"Use only predefined payment-term options, replace existing custom values, and restrict invoice-settings update access to trusted users until a vendor fix is available. Treat this as temporary mitigation rather than a fix."}],"revision":"d620a608fc099f8b245150fac8585e5c853a7baef6de0ae71030b796d6f97c77","sources":[{"modifiedAt":1794463774999,"name":"CNA: Fluid Attacks","retrievedAt":1794467309746,"url":"https://www.cve.org/CVERecord?id=CVE-2026-118597"}],"ssvc":null,"status":"published","title":"Akaunting 3.3.0 - Stored XSS in custom invoice payment terms","updatedAt":1794467309746}