Back to overview

CVE-2026-31843

CRITICAL
9.8
CVSS 3.1
Description
The goodoneuz/pay-uz Laravel package (<= 2.2.24) contains a critical vulnerability in the /payment/api/editable/update endpoint that allows unauthenticated attackers to overwrite existing PHP payment hook files. The endpoint is exposed via Route::any() without authentication middleware, enabling remote access without credentials. User-controlled input is directly written into executable PHP files using file_put_contents(). These files are later executed via require() during normal payment processing workflows, resulting in remote code execution under default application behavior. The payment secret token mentioned by the vendor is unrelated to this endpoint and does not mitigate the vulnerability.

Metadata

CVE ID
CVE-2026-31843
State
PUBLISHED
Assigner
TuranSec
Reserved
2026-03-09 18:20 UTC
Published
2026-04-16 13:02 UTC
Last updated
2026-04-16 19:30 UTC
Primary CWE
CWE-284
CWE-284 Improper Access Control leading to unauthorized modi…
Vendor / Product
goodoneuz / pay-uz
Sources
cve.org  ·  NVD

Severity & Metrics

9.8 CRITICAL CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SSVC — CISA Coordinator
Exploitation
none
Automatable
yes
Tech. Impact
total
Affected products (1)
VendorProductPlatformVersions
goodoneuz pay-uz — <= 2.2.24
Weakness (CWE)
CWESourceDescription
CWE-284 cna CWE-284 Improper Access Control leading to unauthorized modification of executable application files
CVSS scores (3)
ScoreSeverityVersionSourceVector
10.0 CRITICAL 4.0 cna CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
10.0 N/D 2.0 cna AV:N/AC:L/Au:N/C:C/I:C/A:C
9.8 CRITICAL 3.1 cna CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References (4)
Back to overview