Stored XSS in Akaunting Invoice Import via Recurring Invoice

Executive Summary

CVE-2026-119275 is a stored cross-site scripting (XSS) vulnerability in Akaunting 3.3.0. An authenticated Manager can import an invoice with a malicious invoice number containing HTML via XLSX. When a victim views a recurring invoice linked to this child invoice, the system raw-renders the invoice number in an anchor tag, executing the attacker's script in the victim's browser.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect Akaunting instances running version 3.3.0 for malicious invoice numbers in recurring invoices. Check the children.blade.php template for raw HTML rendering of document_number fields. Review imported XLSX files for invoice numbers containing HTML or JavaScript payloads. Monitor browser console logs for unexpected script execution when viewing recurring invoices.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker to execute malicious JavaScript in a victim's browser when they view a recurring invoice. This could lead to session hijacking, theft of sensitive data, or unauthorized actions within the victim's existing permissions. The attack requires the victim to open the affected recurring invoice.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade Akaunting to a patched version. Restrict invoice-import permissions to trusted administrators only. Avoid opening recurring invoices linked to untrusted imports. Review all imported invoices for malicious document numbers. Implement input validation to neutralize HTML in invoice numbers during import. Escape document_number when constructing child links in templates.

Useful 0 Not Useful 0