CVE-2026-61686

Name of the Vulnerable Software and Affected Versions SolidInvoice versions prior to 3.0.1

Description The DataGrid LiveComponent deserializes a context prop value using the PHP unserialize() function after receiving it from the client. Since the prop is marked as writable: true, an authenticated attacker can provide an arbitrary PHP serialized payload, leading to potential code execution through PHP object injection, which occurs when untrusted user input is passed to the unserialize() function.

Recommendations Update to version 3.0.1.