CVE-2026-118597: Akaunting 3.3.0 - Stored XSS in custom invoice payment terms
Published Nov 12, 2026
·Updated
Akaunting 3.3.0 contains a stored cross-site scripting vulnerability in custom invoice payment terms. An authenticated Manager can save a crafted custom payment-term value. When an authorized user opens Invoice Settings for the same company, Akaunting inserts the stored value into a client-side event-handler expression, causing attacker-controlled JavaScript to execute in the victim's authenticated origin.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Serialize the custom invoice payment-term value with Laravel Js::from() or a framework data-binding mechanism before inserting it into client-side code.
- Compensating control
Validate the custom invoice payment-term value as a bounded integer when it represents a number of days.
Event History
Nov 12, 2026
CVE Published
via MITRE·06:09 AM
Data Sourced
via MITRE·06:09 AM
RemedyDescriptionWeakness