CVE-2026-61686: SolidInvoice: PHP unserialize() called on client-controlled data in DataGrid LiveComponent context prop
SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, the DataGrid LiveComponent deserializes a context prop value using PHP's unserialize() after receiving it from the client. Because the prop is marked writable: true, an authenticated attacker can supply an arbitrary PHP serialized payload. Version 3.0.1 fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SolidInvoice (DataGrid LiveComponent)to a version that resolves this vulnerability.Fixed in 3.0.1
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated and able to submit a modified DataGrid LiveComponent context property. The vulnerable property is writable by the client, so no user interaction is required once the attacker has the needed access.
What is the impact of successful exploitation?
Successful exploitation can result in high-impact compromise of confidentiality, integrity, and availability. Exploitation requires crafting an appropriate serialized payload, reflected by the high attack complexity rating.
Which deployments are affected and what is the fix?
SolidInvoice versions prior to 3.0.1 are affected. Upgrade to version 3.0.1, which fixes the unsafe deserialization of the client-provided context value.