CVE-2026-61686

SolidInvoice, an open-source invoicing platform, passes a client-supplied 'context' prop to its DataGrid LiveComponent and deserializes it with PHP's unserialize() function, and versions before 3.0.1 fail to constrain what authenticated users can place in that prop. Because the prop is marked writable, any authenticated user can submit an arbitrary PHP-serialized payload, which the server then unserializes without validation. An attacker can achieve PHP object injection, potentially leading to code execution or other high-impact effects; the CVSS score rates confidentiality, integrity, and availability impact as high, though attack complexity is high, likely because exploitation depends on suitable gadget chains present in the installed class libraries. Only deployments of SolidInvoice earlier than 3.0.1 are affected, and triggering the flaw requires a valid low-privilege account with no user interaction. There is no public proof-of-concept or known exploitation; EPSS estimates roughly a 0.4% chance of exploitation within the next 30 days.

What to do: Upgrade to SolidInvoice 3.0.1 or later, which fixes the issue. If an immediate upgrade is not possible, limit application access to trusted authenticated users and review logs for unusual serialized payloads submitted to LiveComponent endpoints; prioritize internet-facing deployments that expose accounts to outside users.