CVE-2026-119275: Akaunting 3.3.0 - Stored XSS through imported invoice numbers
Akaunting 3.3.0 contains a stored cross-site scripting vulnerability in the XLSX invoice-import workflow. An authenticated Manager can import a child invoice whose invoice number contains HTML and is linked to a recurring invoice. When a victim opens that recurring invoice, Akaunting raw-renders the stored child number in an anchor, causing attacker-controlled markup to execute in the victim's browser.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Escape document_number when rendering it in the recurring-child view and remove the raw translation sink so the value is not interpreted as HTML.
Akaunting recurring-child view document_number rendering = escaped - Configuration
Normalize or reject HTML/markup in imported invoice numbers before storing them.
Akaunting XLSX invoice-import workflow invoice-number markup handling = normalize or reject markup - Compensating control
Add import-to-recurring-child rendering regression tests covering invoice numbers containing HTML.
Event History
Frequently Asked Questions
Who can exploit this issue, and who is at risk?
An authenticated user with the Manager role can exploit it by importing a crafted child invoice. Users who open the associated recurring invoice are exposed to the stored script executing in their browser.
What conditions are required for exploitation?
The attacker must be able to use the XLSX invoice-import workflow, create or import a child invoice with attacker-controlled HTML in its invoice number, and link that child invoice to a recurring invoice. The payload executes when a victim opens that recurring invoice.
How can administrators identify potentially affected records?
Review child invoices imported through XLSX that are linked to recurring invoices, especially invoice-number values containing HTML or markup-like characters. Opening the related recurring invoice is the relevant rendering path.