CVE-2026-118368: Akaunting 3.3.0 - Stored XSS through imported item names
Published Nov 11, 2026
·Updated
Akaunting 3.3.0 contains a stored cross-site scripting vulnerability in the XLSX item-import workflow. An authenticated Manager can import an item whose name contains HTML. When another authenticated user selects that item while creating a document, Akaunting places the stored name in an invoice or bill line item through Vue v-html, causing attacker-controlled markup to execute in the victim's Akaunting origin.
Affected Software
1 affected component
Akaunting Akaunting=3.3.0
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Apply the upstream patch so imported item names are treated as untrusted text in every write path, and replace document line-item v-html rendering with a text-only Vue binding.
Akaunting XLSX item-import workflow Imported item-name handling = Treat imported item names as untrusted text in every write path
Event History
Nov 11, 2026
CVE Published
via MITRE·04:40 AM
Data Sourced
via MITRE·04:40 AM
RemedyDescriptionWeakness
Data Sourced
via NVD·05:19 AM
DescriptionSeverityWeakness