Description

SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, the `DataGrid` LiveComponent deserializes a `context` prop value using PHP's `unserialize()` after receiving it from the client. Because the prop is marked `writable: true`, an authenticated attacker can supply an arbitrary PHP serialized payload. Version 3.0.1 fixes the issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-04T18:17:55.437Z",
  "pubdate": "2026-09-04T18:17:55.437Z",
  "executiveSummary": "SolidInvoice versions prior to 3.0.1 contain a critical PHP object injection vulnerability within the DataGrid LiveComponent. This flaw arises from the insecure deserialization of user-supplied data provided through a writable component property. An authenticated attacker can leverage this vulnerability to inject arbitrary PHP serialized objects into the application state.\nThe primary risk involves Remote Code Execution (RCE), as the deserialization process may trigger the instantiation of arbitrary classes present within the application's autoloader. By crafting a malicious payload, an attacker can manipulate object properties or trigger destructors and magic methods to achieve unauthorized code execution, bypass security controls, or manipulate application logic. Given the nature of PHP object injection, successful exploitation can lead to a complete system compromise, including unauthorized data access and total control over the host server environment. The attack requires the user to be authenticated, but does not necessitate additional privileges beyond the ability to interact with the affected DataGrid component.",
  "technicalDetails": "The vulnerability resides in the DataGrid LiveComponent within the SolidInvoice invoicing platform. The component accepts a 'context' prop from the client-side, which is explicitly defined as 'writable: true'. This configuration allows the client to influence the state of the component directly. The application logic subsequently processes this 'context' prop by passing it to the native PHP unserialize() function without prior validation or sanitization.\nPHP's unserialize() function is inherently dangerous when processing untrusted input. When an object is serialized, the structure and properties are preserved, and when unserialized, PHP attempts to reconstruct the object. If an attacker provides a crafted serialized string representing a class existing within the application's scope, the PHP engine will instantiate that object. This instantiation process can trigger 'magic methods'—specifically __wakeup(), __destruct(), or __toString()—which may execute arbitrary code or perform unintended operations if the class is designed to handle state transitions or cleanup tasks.\nThe attack flow proceeds as follows: 1) An authenticated user observes the client-side communication and identifies the 'context' prop being sent to the DataGrid LiveComponent. 2) The attacker crafts a malicious serialized payload designed to leverage existing 'gadget chains'—specific classes within the application or its dependencies that perform sensitive operations (such as file system interactions, database queries, or arbitrary function calls) during object destruction or wakeup. 3) The attacker submits the serialized payload via the writable component property. 4) The server-side DataGrid component processes the input through unserialize(). 5) The execution of the gadget chain leads to Remote Code Execution under the privileges of the web server process.\nBecause the payload is delivered through a legitimate communication channel used by the LiveComponent, it bypasses standard client-side input validation. The vulnerability is restricted to versions prior to 3.0.1. Impact is severe, as it facilitates full server-side command execution, enabling the attacker to exfiltrate database contents, deploy web shells, or pivot into the internal network infrastructure."
}