CVE-2026-118597

Description

Akaunting 3.3.0 contains a stored cross-site scripting vulnerability in custom invoice payment terms. An authenticated Manager can save a crafted custom payment-term value. When an authorized user opens Invoice Settings for the same company, Akaunting inserts the stored value into a client-side event-handler expression, causing attacker-controlled JavaScript to execute in the victim's authenticated origin.

References

• https://fluidattacks.com/advisories/rhiannon
• https://github.com/akaunting/akaunting
• https://github.com/akaunting/akaunting/blob/3.3.0/app/Abstracts/Http/SettingController.php
• https://github.com/akaunting/akaunting/blob/3.3.0/app/View/Components/Form/Group/PaymentTerm.php
• https://github.com/akaunting/akaunting/blob/3.3.0/resources/views/components/form/group/payment_term.blade.php