Arbitrary Code Execution Vulnerability in SolidInvoice Open-Source Invoicing Platform
CVE-2026-61686

7.5HIGH

Key Information:

Vendor

Solidinvoice

Status
Solidinvoice
Vendor
CVE Published:
4 September 2026

What is CVE-2026-61686?

In the SolidInvoice open-source invoicing platform, prior to version 3.0.1, a vulnerability exists in the DataGrid LiveComponent. This issue arises from the insecure deserialization of a client-supplied context prop using PHP's unserialize() method. The context prop, marked writable: true, allows an authenticated attacker to inject a maliciously constructed PHP serialized payload, potentially resulting in arbitrary code execution. The vulnerability has been addressed in version 3.0.1.

Affected Version(s)

SolidInvoice < 3.0.1

References

https://github.com/SolidInvoice/SolidInvoice/security/adv...
x_refsource_CONFIRM
https://github.com/SolidInvoice/SolidInvoice/releases/tag...
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.