AKAUNTING · CVE-2026-118855 · Package
NO FIX YET · SEE WHAT TO DO
Akaunting 3.3.0 accepts any string as invoice status when invoices are imported from XLSX and prints it unescaped in a hidden input on the invoice edit form. A user with invoice-creation rights (Manager role in the PoC) can run script in the session of an administrator who opens that invoice. A public PoC is in the discoverer's advisory; no exploitation reported.
first public Nov 12, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams that run Akaunting 3.3.0 and let more than one authenticated user create or import invoices are exposed. An attacker needs an account with invoice-creation permission, and the payload fires when a different user opens the invoice edit form. Installations with a single user, or where only trusted staff can import invoices, carry much less risk.
Not affected if no-invoice-import-permission, single-user-install, versions-other-than-3.3.0
Who cares akaunting, invoicing, php, self-hosted, stored-xss
3.3.0 is the only affected version nameddraft,paid,partial,sent,received,viewed,); (also check your installed version's list of statuses, added accrued/outstanding status groups)Akaunting 3.3.0 contains a stored cross-site scripting vulnerability through invoice import. An authenticated user with invoice-creation permission can import HTML in an invoice status field. When another authenticated user opens that invoice's edit form, Akaunting renders the stored status in a hidden input with raw Blade output, allowing attacker-controlled markup to execute in the victim's Akaunting origin.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
cancelled3.3.13.3.1 (released 11 Nov 2026) release notes do not list this issue; check the 3.3.1 code for hidden.blade.php using {{ }} and the status allowlist in Document.php before relying on it