CVE-2026-118855: Akaunting 3.3.0 - Stored XSS in invoice edit form through imported status
Akaunting 3.3.0 contains a stored cross-site scripting vulnerability through invoice import. An authenticated user with invoice-creation permission can import HTML in an invoice status field. When another authenticated user opens that invoice's edit form, Akaunting renders the stored status in a hidden input with raw Blade output, allowing attacker-controlled markup to execute in the victim's Akaunting origin.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Restore a strict allowlist for invoice statuses during normal validation and spreadsheet-import validation.
Akaunting invoice status validation invoice status allowlist = strict allowlist - Configuration
Encode the hidden-input value in attribute context instead of rendering it with raw Blade output.
Akaunting hidden-input component attribute-context encoding = enabled
Event History
Frequently Asked Questions
Who can introduce the malicious content?
An authenticated Akaunting user who has permission to create invoices can introduce it by importing HTML into an invoice status field.
What must happen for the stored content to execute?
Another authenticated user must open the affected invoice's edit form. The application renders the stored status in a hidden input using raw Blade output, allowing attacker-controlled markup to execute in that user's Akaunting origin.