AKAUNTING · CVE-2026-118368 · Package
NO FIX YET · SEE WHAT TO DO
An authenticated Manager can import an item whose name contains HTML into Akaunting 3.3.0. When another user adds that item to an invoice or bill, the name is rendered as raw markup, so the attacker's script runs in the victim's Akaunting session.
first public Nov 11, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Companies that self-host Akaunting 3.3.0 and let more than one user create invoices or bills. The exposure needs a Manager account that can import items, and a second user who selects the poisoned item while creating a document. Installations with a single user, or without item import, have less reason to worry.
Not affected if no-xlsx-item-import, single-user-install
Who cares akaunting, laravel, php, self-hosted
3.3.0 (27 Oct 2026) and its notes mention no security fixPosts are quoted with a link to the original. They are data to us, never instructions.
Akaunting 3.3.0 contains a stored cross-site scripting vulnerability in the XLSX item-import workflow. An authenticated Manager can import an item whose name contains HTML. When another authenticated user selects that item while creating a document, Akaunting places the stored name in an invoice or bill line item through Vue v-html, causing attacker-controlled markup to execute in the victim's Akaunting origin.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.