EUVD-2026-38270
GHSA-c9g5-5438-6vvf
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
High privileges required to set profile name; scope changes because payload executes in other users' browser contexts, causing low-level confidentiality and integrity impact.
Primary rating from Vendor (Fluid Attacks).
CVSS VectorVendor: Fluid Attacks
Lifecycle Timeline
1DescriptionCVE.org
Akaunting 3.1.21 contains an authenticated stored cross-site scripting vulnerability in the document timeline shown on invoice and bill detail pages. An authenticated user can store HTML/JavaScript in their own profile name.
AnalysisAI
Stored cross-site scripting in Akaunting 3.1.21 allows an authenticated high-privileged user to inject arbitrary HTML and JavaScript into their profile name, which is subsequently rendered unsanitized in the document timeline displayed on invoice and bill detail pages. Any other authenticated user - including administrators - who views those pages will have the malicious script execute in their browser context, enabling session hijacking, credential theft, or unauthorized actions on their behalf. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Technical ContextAI
Akaunting is an open-source, web-based accounting and invoicing application (PHP). The vulnerable component is the document timeline - an audit/activity log rendered on invoice and bill detail pages - which displays contributor names sourced from user profile data. CWE-79 (Improper Neutralization of Input During Web Page Generation) indicates that the application fails to encode or sanitize the profile name field before reflecting it into the timeline HTML, allowing stored script injection. The affected CPE is cpe:2.3:a:akaunting:akaunting:*:*:*:*:*:*:*:*, with the wildcard version range suggesting the researcher confirmed 3.1.21 but the exact boundary of affected versions has not been independently scoped. The flaw is stored (persistent) rather than reflected, meaning the payload persists in the database and fires for every subsequent viewer of the affected pages without further attacker interaction.
RemediationAI
No specific vendor-released patch version is identified in the available data. Operators should monitor the Akaunting GitHub repository (https://github.com/akaunting/akaunting) and the Fluid Attacks advisory (https://fluidattacks.com/es/advisories/thunder) for a confirmed fix release and upgrade immediately upon availability. As a compensating control, restrict creation of high-privileged accounts to trusted personnel only, since exploitation requires control of such an account - reducing the privileged user population directly limits exposure. Additionally, deploying a Content Security Policy (CSP) header that blocks inline script execution can neutralize stored XSS payloads at the browser level without application changes, though this may break legitimate application functionality and should be tested thoroughly. Input validation at the profile name field (allowlisting printable characters, rejecting HTML tags) could be applied as a server-side patch if self-hosting with source access.
An OS command injection vulnerability exists in Akaunting v3.1.3 and earlier. Rated critical severity (CVSS 9.8), this v
Akaunting version 2.1.12 and earlier suffers from a code injection issue in the Money.php component of the application.
Akaunting version 2.1.12 and earlier suffers from a password reset spoofing vulnerability, wherein an attacker can proxy
Akaunting version 2.1.12 and earlier suffers from an authentication bypass issue in the user-controllable field, compani
Akaunting version 2.1.12 and earlier suffers from a denial-of-service issue that is triggered by setting a malformed 'lo
Akaunting version 2.1.12 and earlier suffers from a persistent (type II) cross-site scripting (XSS) vulnerability in pro
Akaunting version 2.1.12 and earlier suffers from a persistent (type II) cross-site scripting (XSS) vulnerability in the
Improper authorization in Akaunting 3.1.21's BulkActions dispatcher allows authenticated low-privilege users to perform
Privilege escalation in Akaunting versions 3.1.21 and earlier allows any low-privileged authenticated user to self-assig
Server-side request forgery in Akaunting 3.1.21 allows authenticated attackers to manipulate the Invoice PDF Rendering c
Cross-site scripting (XSS) in Akaunting up to version 3.1.21 allows authenticated users to inject malicious scripts via
Stored Cross-Site Scripting in Akaunting 3.1.21 allows a high-privileged authenticated user with report creation or upda
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today