Akaunting version 3.3.0 has a stored cross-site scripting (XSS) vulnerability in its XLSX item-import workflow. An authenticated Manager can import an item with a name containing HTML markup. When another authenticated user selects this item during document creation, the stored HTML is rendered unsafely via Vue's v-html directive, leading to execution of attacker-controlled code within the victim's Akaunting session.