{"id":"CVE-2026-118368","kind":"vulnerability","aliases":["CVE-2026-118368"],"related":[],"title":"Akaunting: stored XSS via XLSX item import runs script in other users' sessions","description":"Akaunting 3.3.0 contains a stored cross-site scripting vulnerability in the XLSX item-import workflow. An authenticated Manager can import an item whose name contains HTML. When another authenticated user selects that item while creating a document, Akaunting places the stored name in an invoice or bill line item through Vue v-html, causing attacker-controlled markup to execute in the victim's Akaunting origin.","summary":"An authenticated Manager can import an item whose name contains HTML into Akaunting 3.3.0. When another user adds that item to an invoice or bill, the name is rendered as raw markup, so the attacker's script runs in the victim's Akaunting session.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"akaunting","fixed":[],"affected":"3.3.0","ecosystem":"composer"}],"ecosystems":[],"tags":["akaunting","laravel","package","php","self-hosted"],"not_affected_if":["no-xlsx-item-import","single-user-install"],"how_to_check":"- Check the installed Akaunting version (admin footer or composer.json); 3.3.0 is the version named in the CVE. Earlier versions are not stated either way.\n- Search the items table for names containing '<' (e.g. SELECT id,name FROM items WHERE name LIKE '%<%';), especially items created through XLSX import.\n- Review who holds the Manager role / import permission.","fix":"No fixed release known. Latest release is 3.3.0 (27 Oct 2026) and its notes mention no security fix. Until one ships: restrict the Manager role/item import to trusted users, and review imported item names for HTML. Upstream-suggested patch (per the CVE record): treat imported item names as untrusted text on every write path and replace the v-html binding in components/documents/form/line-item.blade.php with a text-only binding.","status":"open","published_at":"2026-11-11T05:19:27+00:00","first_seen_at":"2026-11-11T05:25:39+00:00","triaged_at":"2026-11-11T05:26:39+00:00","updated_at":"2026-11-11T05:27:35+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-11T05:26:39Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Akaunting: stored XSS via XLSX item import runs script in other users' sessions","impact":"medium","summary":"An authenticated Manager can import an item whose name contains HTML into Akaunting 3.3.0. When another user adds that item to an invoice or bill, the name is rendered as raw markup, so the attacker's script runs in the victim's Akaunting session.","audience":"businesses","category":"package","nicknames":[],"who_cares":["akaunting","self-hosted","php","laravel"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"script runs in other users' Akaunting sessions, exposing their data","analyst_note":"Find the fixed Akaunting version and any patch from the NVD entry or the Akaunting release notes; the sources given do not state one.","how_to_check":"- Check the installed Akaunting version in the app's `composer.json` or the admin footer; version `3.3.0` is affected per the description\n- Review existing items imported from XLSX files for HTML characters such as `<script` in item names\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["single-user-install","no-xlsx-item-import"],"who_is_affected":"Companies that self-host Akaunting 3.3.0 and let more than one user create invoices or bills. The exposure needs a Manager account that can import items, and a second user who selects the poisoned item while creating a document. Installations with a single user, or without item import, have less reason to worry.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000741,"input_tokens":4591,"output_tokens":564,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the fixed Akaunting version and any patch from the NVD entry or the Akaunting release notes; the sources given do not state one.","search":"'-118368':16A,19A '-2026':15A,18A '3.3.0':41B,73C 'add':45B 'akaunt':1A,21B,40B,70B,72C,111C,139C 'akaunting':20A 'anoth':43B,101C 'attack':62B,130C 'attacker-control':129C 'authent':29B,90C,102C 'bill':52B,120C 'caus':128C 'contain':37B,74C,98C 'control':131C 'creat':108C 'cross':78C 'cross-sit':77C 'cve':14A,17A 'document':110C 'execut':134C 'host':27B 'html':38B,99C,127C 'import':7A,32B,87C,93C 'invoic':50B,118C 'item':6A,34B,47B,86C,95C,106C,122C 'item-import':85C 'laravel':22B 'line':121C 'manag':30B,91C 'markup':59B,132C 'name':36B,54B,97C,115C 'origin':140C 'packag':23B 'php':24B 'place':112C 'raw':58B 'render':56B 'run':8A,65B 'script':9A,64B,80C 'select':104C 'self':26B 'self-host':25B 'session':13A,71B 'site':79C 'store':2A,76C,114C 'user':12A,44B,103C 'v':126C 'v-html':125C 'via':4A 'victim':68B,137C 'vue':124C 'vulner':81C 'whose':35B,96C 'workflow':88C 'xlsx':5A,84C 'xss':3A","nicknames":[],"mitigations":[],"who_affected":"Companies that self-host Akaunting 3.3.0 and let more than one user create invoices or bills. The exposure needs a Manager account that can import items, and a second user who selects the poisoned item while creating a document. Installations with a single user, or without item import, have less reason to worry.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["akaunting"],"ptokens":["akaunting"],"labels":["akaunting","high","laravel","package","php","selfhosted"],"campaign_type":null,"search_a":"'-118368':16A,19A '-2026':15A,18A 'akaunt':1A 'akaunting':20A 'cve':14A,17A 'import':7A 'item':6A 'run':8A 'script':9A 'session':13A 'store':2A 'user':12A 'via':4A 'xlsx':5A 'xss':3A","search_b":"'3.3.0':41B 'add':45B 'akaunt':21B,40B,70B 'anoth':43B 'attack':62B 'authent':29B 'bill':52B 'contain':37B 'host':27B 'html':38B 'import':32B 'invoic':50B 'item':34B,47B 'laravel':22B 'manag':30B 'markup':59B 'name':36B,54B 'packag':23B 'php':24B 'raw':58B 'render':56B 'run':65B 'script':64B 'self':26B 'self-host':25B 'session':71B 'user':44B 'victim':68B 'whose':35B","search_c":"'3.3.0':73C 'akaunt':72C,111C,139C 'anoth':101C 'attack':130C 'attacker-control':129C 'authent':90C,102C 'bill':120C 'caus':128C 'contain':74C,98C 'control':131C 'creat':108C 'cross':78C 'cross-sit':77C 'document':110C 'execut':134C 'html':99C,127C 'import':87C,93C 'invoic':118C 'item':86C,95C,106C,122C 'item-import':85C 'line':121C 'manag':91C 'markup':132C 'name':97C,115C 'origin':140C 'place':112C 'script':80C 'select':104C 'site':79C 'store':76C,114C 'user':103C 'v':126C 'v-html':125C 'victim':137C 'vue':124C 'vulner':81C 'whose':96C 'workflow':88C 'xlsx':84C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T05:19:27+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"help@fluidattacks.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118368","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118368","severity":null,"published_at":"2026-11-11T05:19:27+00:00","modified_at":"2026-11-11T05:19:27+00:00","first_seen_at":"2026-11-11T05:25:39+00:00","fetched_at":"2026-11-11T05:25:39+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-118368:3502","url":"https://github.com/akaunting/akaunting/releases","severity":null,"published_at":"2026-11-11T05:27:35+00:00","modified_at":"2026-11-11T05:27:35+00:00","first_seen_at":"2026-11-11T05:27:35+00:00","fetched_at":"2026-11-11T05:27:35+00:00","note":"Source: CVE record (Fluid Attacks CNA; Fluid Attacks advisory page not retrievable) via HOL mirror. Akaunting release page shows 3.3.0 as latest, no fix found. Nothing marked verified: no vendor statement of fix status read.","cites":["https://github.com/akaunting/akaunting/releases","https://hol.org/guard/security/cves/CVE-2026-118368-akaunting-330-stored-xss-through-imported-item"]}],"documents":[{"id":122939,"url":"https://github.com/akaunting/akaunting/releases","title":"Akaunting releases (3.3.0 latest, 27 Oct)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":122940,"url":"https://hol.org/guard/security/cves/CVE-2026-118368-akaunting-330-stored-xss-through-imported-item","title":"HOL Guard: CVE-2026-118368 (mirrors CVE record, suggested remediation)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}