A critical deserialization vulnerability in SolidInvoice, fixed in version 3.0.1, allows authenticated attackers to execute arbitrary code on the underlying server.

The application utilizes an insecure PHP unserialize call on user controlled data within the DataGrid LiveComponent. Because the context property is marked as writable, an authenticated user can inject a malicious serialized payload to trigger remote code execution.

Successful exploitation of this vulnerability permits an authenticated attacker to execute arbitrary code with the privileges of the web server. This could lead to a complete compromise of the invoicing platform, including the theft of sensitive financial data, unauthorized modifications to records, and total system control. Given the CVSS score of 7.5, this high severity flaw represents a significant risk to organizational confidentiality and integrity.

Immediate Action: Update the SolidInvoice platform to version 3.0.1 or later immediately to resolve the insecure deserialization flaw.

Proactive Monitoring: Review web server and application logs for anomalous requests directed at the DataGrid component that contain serialized PHP structures or suspicious object strings.

Compensating Controls: Implement strict input validation or use a Web Application Firewall to block common PHP object injection patterns, though these should only be considered temporary measures until the patch is applied.

Public Exploit Available: Unknown

The vulnerability poses a severe risk to the security of the SolidInvoice environment. Administrators must prioritize upgrading to version 3.0.1 without delay to eliminate the underlying injection vector. Failure to patch leaves the system vulnerable to unauthorized code execution by any authenticated user.