Akaunting 3.3.0 contains a stored cross-site scripting vulnerability through invoice import. An authenticated user with invoice-creation permission can import HTML in an invoice status field. When another authenticated user opens that invoice's edit form, Akaunting renders the stored status in a hidden input with raw Blade output, allowing attacker-controlled markup to execute in the victim's Akaunting origin.
Restrict invoice-import permission to trusted users and do not open edit pages for invoices imported from untrusted sources. Remove document rows whose status is not a supported state identifier. These measures are temporary and do not replace output encoding.
Restore a strict allowlist for invoice statuses during normal and spreadsheet-import validation, and change the hidden-input component to encode its value in attribute context. Upgrade to the vendor-fixed release once one is published.