CVE-2026-118855— Akaunting 3.3.0 - Stored XSS in invoice edit form through imported status

Quick assessment

Affected

Akaunting Akaunting

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Akaunting 3.3.0 存在一个通过发票导入功能引发的存储型跨站脚本（XSS）漏洞。拥有发票创建权限的已认证用户可以在发票的“状态”字段中导入 HTML 内容。当另一名已认证用户打开该发票的编辑表单时，Akaunting 会将存储的状态值以原始 Blade 输出形式渲染到一个隐藏输入框中，从而导致攻击者控制的标记代码在受害者的 Akaunting 域名上下文中执行。

CVSS 7.0 · High Updated Nov 12, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Akaunting 3.3.0 - Stored XSS in invoice edit form through imported status

Source: CVE Program / CVE List V5

Vulnerability Description

Akaunting 3.3.0 contains a stored cross-site scripting vulnerability through invoice import. An authenticated user with invoice-creation permission can import HTML in an invoice status field. When another authenticated user opens that invoice's edit form, Akaunting renders the stored status in a hidden input with raw Blade output, allowing attacker-controlled markup to execute in the victim's Akaunting origin.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

在Web页面生成时对输入的转义处理不恰当(跨站脚本)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Akaunting	Akaunting	3.3.0	-

II. Public POCs for CVE-2026-118855

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-118855

请登录查看更多情报信息。

Other References for CVE-2026-118855 (3)

https://github.com/akaunting/akaunting/blob/3.3.0/app/Http/Requests/Document/Document.php technical-description
https://fluidattacks.com/advisories/sabbath third-party-advisory
https://github.com/akaunting/akaunting/blob/3.3.0/resources/views/components/form/input/hidden.blade.php technical-description

https://www.cve.org/CVERecord?id=CVE-2026-118855

IV. Related Vulnerabilities

Same product: Akaunting

Same vendor: Akaunting

Same weakness: CWE-79