---
id: "CVE-2026-118368"
page: "https://infrastack.ai/live/CVE-2026-118368"
kind: "vulnerability"
aliases: ["CVE-2026-118368"]
title: "Akaunting: stored XSS via XLSX item import runs script in other users' sessions"
severity: "high"
cvss: 7.0
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "akaunting", "fixed": [], "affected": "3.3.0", "ecosystem": "composer"}]
ecosystems: []
tags: ["akaunting", "laravel", "package", "php", "self-hosted"]
not_affected_if: ["no-xlsx-item-import", "single-user-install"]
published_at: "2026-11-11T05:19:27+00:00"
first_seen_at: "2026-11-11T05:25:39+00:00"
updated_at: "2026-11-11T05:27:35+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118368", "first_seen_at": "2026-11-11T05:25:39+00:00"}, {"source": "analyst", "url": "https://hol.org/guard/security/cves/CVE-2026-118368-akaunting-330-stored-xss-through-imported-item", "first_seen_at": "2026-11-11T05:27:35+00:00", "cites": ["https://hol.org/guard/security/cves/CVE-2026-118368-akaunting-330-stored-xss-through-imported-item", "https://github.com/akaunting/akaunting/releases"]}]
exploit_sources: []
---

# Akaunting: stored XSS via XLSX item import runs script in other users' sessions

Link for people: https://infrastack.ai/live/CVE-2026-118368 (this .md is for agents)

An authenticated Manager can import an item whose name contains HTML into Akaunting 3.3.0. When another user adds that item to an invoice or bill, the name is rendered as raw markup, so the attacker's script runs in the victim's Akaunting session.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- composer:akaunting affected 3.3.0 fixed no fixed version listed

## How to check

- Check the installed Akaunting version (admin footer or composer.json); 3.3.0 is the version named in the CVE. Earlier versions are not stated either way.
- Search the items table for names containing '<' (e.g. SELECT id,name FROM items WHERE name LIKE '%<%';), especially items created through XLSX import.
- Review who holds the Manager role / import permission.

## Fix

No fixed release known. Latest release is 3.3.0 (27 Oct 2026) and its notes mention no security fix. Until one ships: restrict the Manager role/item import to trusted users, and review imported item names for HTML. Upstream-suggested patch (per the CVE record): treat imported item names as untrusted text on every write path and replace the v-html binding in components/documents/form/line-item.blade.php with a text-only binding.

## Timeline

- 2026-11-11T05:25:39+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118368
- 2026-11-11T05:27:35+00:00 analyst https://hol.org/guard/security/cves/CVE-2026-118368-akaunting-330-stored-xss-through-imported-item — Source: CVE record (Fluid Attacks CNA; Fluid Attacks advisory page not retrievable) via HOL mirror. Akaunting release page shows 3.3.0 as latest, no fix found. Nothing marked verified: no vendor statement of fix status read.

## Documents

- [describes] HOL Guard: CVE-2026-118368 (mirrors CVE record, suggested remediation) https://hol.org/guard/security/cves/CVE-2026-118368-akaunting-330-stored-xss-through-imported-item
- [mentions] Akaunting releases (3.3.0 latest, 27 Oct) https://github.com/akaunting/akaunting/releases

## From the sources

Akaunting 3.3.0 contains a stored cross-site scripting vulnerability in the XLSX item-import workflow. An authenticated Manager can import an item whose name contains HTML. When another authenticated user selects that item while creating a document, Akaunting places the stored name in an invoice or bill line item through Vue v-html, causing attacker-controlled markup to execute in the victim's Akaunting origin.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_