Akaunting 3.1.21 - Authenticated stored XSS in document timeline
Description
Akaunting 3.1.21 contains an authenticated stored cross-site scripting vulnerability in the document timeline shown on invoice and bill detail pages. An authenticated user can store HTML/JavaScript in their own profile name.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1Patches
Vulnerability mechanics
Root cause
"The user name is stored without HTML sanitization and later rendered as raw HTML in timeline descriptions via Blade's `{!! !!}` syntax, enabling stored cross-site scripting."
Attack vector
An authenticated attacker updates their profile name to include malicious HTML/JavaScript (e.g., `CVE-RESTORE-"><img src=x onerror=alert(document.domain)>`). When that user creates or cancels an invoice or bill, Akaunting stores the attacker-controlled name as the document owner. Another authenticated user viewing the document detail page triggers the payload because the timeline description is rendered as raw Blade output (`{!! $description !!}`) in the accordion header component [ref_id=1]. The attack requires only an authenticated session and the ability to edit one's own profile name.
Affected code
The vulnerability resides in the profile update route (`admin/profile`), the `UpdateUser` job (`app/Jobs/Auth/UpdateUser.php:27-29`), and the Blade templates that render timeline descriptions as raw HTML (`resources/views/components/show/accordion/head.blade.php` uses `{!! $description !!}`). The document timeline components (`app/View/Components/Documents/Show/Create.php` and `Restore.php`) read the stored owner name and interpolate it into translated descriptions without sanitization.
What the fix does
The advisory states that no patch is currently available [ref_id=1]. To remediate the vulnerability, the application must either strip or encode HTML tags from the user name before storage, or escape the interpolated user name in the Blade templates by replacing `{!! $description !!}` with `{{ $description }}` to prevent raw HTML rendering.
Preconditions
- authAttacker must have an authenticated session on the Akaunting instance
- inputAttacker must be able to update their own profile name via the profile update route
- authAnother authenticated user must view the invoice or bill detail page for a document the attacker created or cancelled
Generated on Jun 23, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
1- fluidattacks.com/es/advisories/thundermitrethird-party-advisory
News mentions
0No linked articles in our index yet.