CVE-2026-61686
Received Received - Intake

Authenticated PHP Object Injection in SolidInvoice via Unsafe DataGrid Context

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: GitHub, Inc.

Description
SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, the `DataGrid` LiveComponent deserializes a `context` prop value using PHP's `unserialize()` after receiving it from the client. Because the prop is marked `writable: true`, an authenticated attacker can supply an arbitrary PHP serialized payload. Version 3.0.1 fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-05
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-61686
EUVD
EUVD-2026-71621

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
solidinvoice solidinvoice to 3.0.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-502 The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, a vulnerability exists in the DataGrid LiveComponent which deserializes a context prop value using PHP's unserialize() function after receiving it from the client. The prop is marked as writable, allowing an authenticated attacker to supply an arbitrary PHP serialized payload.

Detection Guidance

Check SolidInvoice version with: composer show solidinvoice/solidinvoice. If version is below 3.0.1, the system is vulnerable. Inspect network traffic for serialized PHP payloads in DataGrid LiveComponent context props.

Impact Analysis

An authenticated attacker could exploit this vulnerability to execute arbitrary code on the server, potentially leading to complete system compromise, data theft, or further network infiltration. This could result in unauthorized access to sensitive invoicing data or financial information.

Compliance Impact

This vulnerability could lead to unauthorized access or exposure of sensitive data, violating GDPR's data protection principles or HIPAA's security requirements. Organizations using affected versions may face compliance violations, legal penalties, and reputational damage.

Mitigation Strategies

Upgrade SolidInvoice to version 3.0.1 or later immediately. If upgrading is not possible, restrict access to authenticated users only and monitor for suspicious activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-61686. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart