Vulnerability · Published Apr 16, 2026 · Assigned by TuranSec

CVE-2026-31843goodoneuz/pay-uz Unauthenticated PHP File Overwrite via /payment/api/editable/update Leading to Remote Code Execution

Critical 9.8

In plain English

A critical-severity improper access control in pay-uz from goodoneuz. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 72% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)1.4%top 27.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The goodoneuz/pay-uz Laravel package (<= 2.2.24) contains a critical vulnerability in the /payment/api/editable/update endpoint that allows unauthenticated attackers to overwrite existing PHP payment hook files. The endpoint is exposed via Route::any without authentication middleware, enabling remote access without credentials.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	goodoneuz/pay-uz	3.0.0	GHSA-m5wg-cjgh-223j

Affected products (as reported)

Vendor	Product	Versions
goodoneuz	pay-uz	<= 2.2.24

Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/shaxzodbek-uzb/pay-uz product
https://github.com/goodoneuz/pay-uz/blob/master/src/routes/web.php issue-tracking
https://github.com/goodoneuz/pay-uz/blob/master/src/Http/Controllers/ApiController.php issue-tracking
https://packagist.org/packages/goodoneuz/pay-uz product