Akaunting: Stored cross-site scripting via imported item names
Summary
Akaunting 3.3.0 contains a stored cross-site scripting vulnerability in the XLSX item import. An authenticated Manager can import an item whose name contains HTML, and when another user selects this item while creating an invoice or bill, the markup is rendered in that user's Akaunting session. An attacker can therefore run scripts in the context of other users, which may allow actions with their privileges. The attack requires a Manager account and a victim who selects the imported item.
Affected
- Akaunting 3.3.0 (according to the CNA; earlier versions unknown)
Fixed in
Unknown.
Workaround
- Restrict item import permission to trusted administrators.
- Review existing item names for HTML or script content.
- Avoid selecting untrusted imported items until a vendor fix is available.
Exploitation
- Not known to be exploited in the wild.
- No public proof of concept found at the time of writing.
Our recommendation
- Limit the Manager role to staff who need it and review who holds it.
- Only import spreadsheets from trusted sources.
- Check existing item names for HTML or script-like text.
- Consider a Content Security Policy as additional protection.
- Monitor the Akaunting repository and release notes for a fixed version and update promptly once available.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE Record CVE-2026-118368 www.cve.org
- Fluid Attacks advisory fluidattacks.com
- Items import code (Akaunting 3.3.0) github.com
- Line item component (Akaunting 3.3.0) github.com
- OffSeq threat radar entry radar.offseq.com
- Akaunting importing items documentation akaunting.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 07:26.
Original description (NVD)
Akaunting 3.3.0 contains a stored cross-site scripting vulnerability in the XLSX item-import workflow. An authenticated Manager can import an item whose name contains HTML. When another authenticated user selects that item while creating a document, Akaunting places the stored name in an invoice or bill line item through Vue v-html, causing attacker-controlled markup to execute in the victim's Akaunting origin.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.