SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, the `DataGrid` LiveComponent deserializes a `context` prop value using PHP's `unserialize()` after receiving it from the client. Because the prop is marked `writable: true`, an authenticated attacker can supply an arbitrary PHP serialized payload. Version 3.0.1 fixes the issue.

CVE-2026-61686 affects SolidInvoice, an open-source invoicing platform, prior to version 3.0.1. The vulnerability exists in the DataGrid LiveComponent, which deserializes a context prop value using PHP's unsafe unserialize() function after receiving it from the client. Because the prop is marked as writable: true, an authenticated attacker can supply an arbitrary PHP serialized payload, potentially leading to remote code execution or other serious impacts. The vulnerability has been patched in version 3.0.1. Users are advised to upgrade immediately to mitigate the risk of exploitation by authenticated attackers.