CVE-2026-118855
Akaunting 3.3.0 - Stored XSS in invoice edit form through imported status
Akaunting 3.3.0 contains a stored cross-site scripting vulnerability through invoice import. An authenticated user with invoice-creation permission can import HTML in an invoice status field. When another authenticated user opens that invoice's edit form, Akaunting renders the stored status in a hidden input with raw Blade output, allowing attacker-controlled markup to execute in the victim's Akaunting origin.
Fixes and workarounds
Fix
Restore a strict allowlist for invoice statuses during normal and spreadsheet-import validation, and change the hidden-input component to encode its value in attribute context. Upgrade to the vendor-fixed release once one is published.
Source: CNA: Fluid AttacksWorkaround
Restrict invoice-import permission to trusted users and do not open edit pages for invoices imported from untrusted sources. Remove document rows whose status is not a supported state identifier. These measures are temporary and do not replace output encoding.
Source: CNA: Fluid AttacksAffected products and versions
| Product | Versions | Authority |
|---|---|---|
| Akaunting Akaunting Platforms: Windows, MacOS, Linux |
3.3.0 (affected, semver)
Other versions: affected |
CNA: Fluid Attacks |
Version ranges are source assertions. Check the vendor advisory and your installed configuration before determining exposure.
CVSS assessments
| Version / score | Vector | Authority |
|---|---|---|
| 4.0 / 7.0 high |
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N | CNA: Fluid Attacks |
Exploit evidence
No exploit evidence in collected sources. This is not proof of no exploitation.
References
- https://fluidattacks.com/advisories/sabbathCNA: Fluid Attacks · third-party-advisory
- https://github.com/akaunting/akauntingCNA: Fluid Attacks · product
- https://github.com/akaunting/akaunting/blob/3.3.0/app/Http/Requests/Document/Document.phpCNA: Fluid Attacks · technical-description
- https://github.com/akaunting/akaunting/blob/3.3.0/resources/views/components/form/input/hidden.blade.phpCNA: Fluid Attacks · technical-description
For agents and automation
Read public disclosures for free as Markdown or JSON. Compatible browsers also expose native WebMCP tools to search disclosures, read this page, and discover API access.
Use the ontology-linked Cyber API with x402 pay per request, or a Y2 Pro or Elite API key with the intel:cyber scope.
Endpoints and access details
https://api.y2.dev/api/v2/cyber/cveshttps://api.y2.dev/api/v2/cyber/cves/{cveId}
A workspace owner or admin can create a Pro or Elite API key. Send Authorization: Bearer <Y2_API_KEY> from your trusted agent runtime.
For x402, omit Authorization and read the HTTP 402 payment challenge before signing a retry. Public browser tools do not make payments.