CVE-2026-119275

Description

Akaunting 3.3.0 contains a stored cross-site scripting vulnerability in the XLSX invoice-import workflow. An authenticated Manager can import a child invoice whose invoice number contains HTML and is linked to a recurring invoice. When a victim opens that recurring invoice, Akaunting raw-renders the stored child number in an anchor, causing attacker-controlled markup to execute in the victim's browser.

Severity scores

Each score is shown as its source gave it. They are not averaged or merged.

• 7.0CVSS 4.0, Highfrom the CNA (Fluid Attacks)CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N

What to do

• Escape document_number in the recurring-child view, remove the raw translation sink, normalize or reject markup in invoice-number imports, and add import-to-recurring-child rendering regression tests.CNA solution statement
• Restrict invoice imports to trusted administrators, inspect existing document numbers for markup, and avoid opening recurring invoices with children imported from untrusted workbooks.CNA workaround statement

Historical context and remediation

This reference retains the original CVE publication date. A recent record update does not mean a new attack occurred.

CAPEC-592 Stored XSS (CNA impact statement)

Version statuses below come from the CNA. An “unaffected” version is not necessarily a currently supported release or proof of a patch date. EPSS is a dated risk estimate, not a count of historical attacks.

Read the original CVE record.

Affected products

Timeline

1. 27 Oct 2026 Vulnerability discovered
2. 29 Oct 2026 Vendor contacted
3. 12 Nov 2026 Public disclosure
4. 12 Nov 2026 Published

Weakness

• CWE-79

References

• fluidattacks.comthird-party-advisory
• github.comproduct
• github.comtechnical-description
• github.comtechnical-description