Stored Cross-Site Scripting in Akaunting by Akaunting
CVE-2026-118368

7HIGH

Key Information:

Vendor

Akaunting

Status
Akaunting
Vendor
CVE Published:
11 November 2026

What is CVE-2026-118368?

Akaunting 3.3.0 has a stored cross-site scripting vulnerability within the XLSX item-import workflow. Authenticated Managers can import items with HTML-encoded names, which are later displayed to other authenticated users. When another user selects the item while generating a document, Akaunting utilizes Vue's v-html to render the stored name. This results in the execution of attacker-controlled markup within the context of the victim's Akaunting environment, leading to potential exploitation.

Affected Version(s)

Akaunting Windows 3.3.0

References

https://fluidattacks.com/es/advisories/tool
third-party-advisory
https://github.com/akaunting/akaunting
product
https://github.com/akaunting/akaunting/blob/3.3.0/app/Imp...
technical-description

CVSS V4

Score:
7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Fluid Attacks' AI SAST Scanner
Miguel GĂłmez
.