CVE-2026-118368— Akaunting 3.3.0 - Stored XSS through imported item names

Quick assessment

Affected

Akaunting Akaunting

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Akaunting 3.3.0 在 XLSX 商品导入流程中存在存储型跨站脚本（XSS）漏洞。已认证的“管理员”（Manager）可以导入名称中包含 HTML 代码的商品。当其他已认证用户在创建单据时选择该商品，Akaunting 会通过 Vue 的指令将存储的商品名称插入到发票或账单的行项目中，导致攻击者控制的标记代码在受害者的 Akaunting 站点上下文中执行。

CVSS 7.0 · High EPSS 0.43% · P37 Updated Nov 11, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

Vendor	Product	Version Range	Status
Akaunting	Akaunting	`3.3.0`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Akaunting 3.3.0 - Stored XSS through imported item names

Source: CVE Program / CVE List V5

Vulnerability Description

Akaunting 3.3.0 contains a stored cross-site scripting vulnerability in the XLSX item-import workflow. An authenticated Manager can import an item whose name contains HTML. When another authenticated user selects that item while creating a document, Akaunting places the stored name in an invoice or bill line item through Vue v-html, causing attacker-controlled markup to execute in the victim's Akaunting origin.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

在Web页面生成时对输入的转义处理不恰当(跨站脚本)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Akaunting	Akaunting	3.3.0	-

II. Public POCs for CVE-2026-118368

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-118368

请登录查看更多情报信息。

Other References for CVE-2026-118368 (3)

https://fluidattacks.com/es/advisories/tool third-party-advisory
https://github.com/akaunting/akaunting/blob/3.3.0/app/Imports/Common/Sheets/Items.php technical-description
https://github.com/akaunting/akaunting/blob/3.3.0/resources/views/components/documents/form/line-item.blade.php technical-description

https://www.cve.org/CVERecord?id=CVE-2026-118368

IV. Related Vulnerabilities

Same product: Akaunting

Same vendor: Akaunting

Same weakness: CWE-79