{"affected":[{"defaultStatus":"affected","platforms":["Windows","MacOS","Linux"],"product":"Akaunting","source":"CNA: Fluid Attacks","vendor":"Akaunting","versions":[{"status":"affected","version":"3.3.0","versionType":"semver"}]}],"cveId":"CVE-2026-118855","cwes":["CWE-79"],"description":"Akaunting 3.3.0 contains a stored cross-site scripting vulnerability through invoice import. An authenticated user with invoice-creation permission can import HTML in an invoice status field. When another authenticated user opens that invoice's edit form, Akaunting renders the stored status in a hidden input with raw Blade output, allowing attacker-controlled markup to execute in the victim's Akaunting origin.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":7,"severity":"high","source":"CNA: Fluid Attacks","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N","version":"4.0"}],"modifiedAt":1794468738994,"publishedAt":1794468738994,"references":[{"source":"CNA: Fluid Attacks","tags":["third-party-advisory"],"url":"https://fluidattacks.com/advisories/sabbath"},{"source":"CNA: Fluid Attacks","tags":["product"],"url":"https://github.com/akaunting/akaunting"},{"source":"CNA: Fluid Attacks","tags":["technical-description"],"url":"https://github.com/akaunting/akaunting/blob/3.3.0/app/Http/Requests/Document/Document.php"},{"source":"CNA: Fluid Attacks","tags":["technical-description"],"url":"https://github.com/akaunting/akaunting/blob/3.3.0/resources/views/components/form/input/hidden.blade.php"}],"remediation":[{"kind":"fix","source":"CNA: Fluid Attacks","text":"Restore a strict allowlist for invoice statuses during normal and spreadsheet-import validation, and change the hidden-input component to encode its value in attribute context. Upgrade to the vendor-fixed release once one is published."},{"kind":"workaround","source":"CNA: Fluid Attacks","text":"Restrict invoice-import permission to trusted users and do not open edit pages for invoices imported from untrusted sources. Remove document rows whose status is not a supported state identifier. These measures are temporary and do not replace output encoding."}],"revision":"13dcebe3ea5f46102ad9c85e6823b153d6cf1e69f8e1d23d179f1f3abda629d2","sources":[{"modifiedAt":1794468738994,"name":"CNA: Fluid Attacks","retrievedAt":1794470903509,"url":"https://www.cve.org/CVERecord?id=CVE-2026-118855"}],"ssvc":null,"status":"published","title":"Akaunting 3.3.0 - Stored XSS in invoice edit form through imported status","updatedAt":1794470903509}