SolidInvoice, an open‑source invoicing platform, suffered a flaw where the DataGrid LiveComponent deserializes a client‑supplied "context" prop using PHP's unserialize() function. The prop is writable, which allows an authenticated user to send arbitrary serialized data. When the component processes this data without validation, it can execute malicious code or tamper with application state. This flaw falls under CWE‑502 and can lead to full compromise of the affected system.

All installations running SolidInvoice versions earlier than 3.0.1 are vulnerable. The vulnerability is present in the core SolidInvoice product; any deployment of the 3.0.0 or earlier releases that include the DataGrid LiveComponent without the patch is affected. No specific operating system or PHP version is cited beyond the general requirement for PHP to parse serialized values.

The CVSS score of 7.5 indicates a high severity level. Because the exploit requires an authenticated session and writable component, the likelihood of casual exploitation is limited, but the potential impact is severe. EPSS data is unavailable, and the issue is not listed in the CISA KEV catalog. Under the current assessment, an attacker with valid credentials could achieve remote code execution, making timely remediation essential.