CVE-2026-61686 SolidInvoice: PHP unserialize() called on client-controlled data in DataGrid LiveComponent context prop
An authenticated attacker can execute arbitrary code by sending a malicious serialized payload to the DataGrid component in SolidInvoice.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-61686?
CVE-2026-61686 is a high-severity unsafe deserialization vulnerability in SolidInvoice, published on 4 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, the `DataGrid` LiveComponent deserializes a `context` prop value using PHP's `unserialize()` after receiving it from the client. Because the prop is marked `writable: true`, an authenticated attacker can supply an arbitrary PHP serialized payload. Version 3.0.1 fixes the issue.
Weakness: CWE-502
Which versions are affected by CVE-2026-61686?
How do I fix CVE-2026-61686?
No fix has been published for CVE-2026-61686 yet. Limit exposure of the affected software until one is available.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2026-61686 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-61686 exists.
Sources
Also known as GHSA-4gj8-frx2-gmp6.