Stored Cross-Site Scripting Vulnerability in Akaunting by Akaunting
CVE-2026-118855

7HIGH

Key Information:

Vendor

Akaunting

Status
Akaunting
Vendor
CVE Published:
12 November 2026

What is CVE-2026-118855?

Akaunting version 3.3.0 contains a stored cross-site scripting vulnerability that can be exploited when an authenticated user with invoice creation permission imports HTML content into the invoice status field. When another authenticated user later accesses the invoice's edit form, the application renders the stored status using raw Blade output in a hidden input. This behavior could allow an attacker to inject and execute malicious scripts within the impacted user's session in the Akaunting environment, posing significant security risks.

Affected Version(s)

Akaunting Windows 3.3.0

References

https://fluidattacks.com/advisories/sabbath
third-party-advisory
https://github.com/akaunting/akaunting
product
https://github.com/akaunting/akaunting/blob/3.3.0/app/Htt...
technical-description

CVSS V4

Score:
7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Fluid Attacks' AI SAST Scanner
Miguel GĂłmez
.