CVE-2026-31843
Full vulnerability record from the local CVENow database.
Description
The goodoneuz/pay-uz Laravel package (<= 2.2.24) contains a critical vulnerability in the /payment/api/editable/update endpoint that allows unauthenticated attackers to overwrite existing PHP payment hook files. The endpoint is exposed via Route::any without authentication middleware, enabling remote access without credentials.
Severity
CRITICAL
CVSS score
10.0
(v4.0)
Vulnerability status
Deferred
Source identifier
309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c
Published
2026-04-16 13:16:48.473000
Last modified
2026-10-26 22:10:00.163000
View original CVE JSON
{
"id": "CVE-2026-31843",
"sourceIdentifier": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"published": "2026-04-16T13:16:48.473",
"lastModified": "2026-10-26T22:10:00.163",
"vulnStatus": "Deferred",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The goodoneuz/pay-uz Laravel package (<= 2.2.24) contains a critical vulnerability in the /payment/api/editable/update endpoint that allows unauthenticated attackers to overwrite existing PHP payment hook files. The endpoint is exposed via Route::any without authentication middleware, enabling remote access without credentials."
},
{
"lang": "es",
"value": "El paquete Laravel goodoneuz/pay-uz (menor o igual que 2.2.24) contiene una vulnerabilidad crítica en el endpoint /payment/API/editable/update que permite a atacantes no autenticados sobrescribir archivos PHP de gancho de pago existentes. El endpoint está expuesto a través de Route::any() sin middleware de autenticación, lo que permite el acceso remoto sin credenciales. La entrada controlada por el usuario se escribe directamente en archivos PHP ejecutables usando file_put_contents(). Estos archivos se ejecutan posteriormente a través de require() durante los flujos de trabajo normales de procesamiento de pagos, lo que resulta en ejecución remota de código bajo el comportamiento predeterminado de la aplicación. El token secreto de pago mencionado por el proveedor no está relacionado con este endpoint y no mitiga la vulnerabilidad."
}
],
"affected": [
{
"source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"affectedData": [
{
"vendor": "goodoneuz",
"product": "pay-uz",
"defaultStatus": "affected",
"collectionURL": "https://packagist.org/packages/goodoneuz/pay-uz",
"packageName": "goodoneuz/pay-uz",
"repo": "https://github.com/shaxzodbek-uzb/pay-uz/",
"versions": [
{
"version": "<= 2.2.24",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 10.0,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"subAvailabilityImpact": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9
}
],
"cvssMetricV2": [
{
"source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"type": "Secondary",
"cvssData": {
"version": "2.0",
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"baseScore": 10.0,
"accessVector": "NETWORK",
"accessComplexity": "LOW",
"authentication": "NONE",
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"availabilityImpact": "COMPLETE"
},
"baseSeverity": "HIGH",
"exploitabilityScore": 10.0,
"impactScore": 10.0,
"acInsufInfo": false,
"obtainAllPrivilege": false,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-04-16T17:23:59.905688Z",
"id": "CVE-2026-31843",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-284"
}
]
}
],
"references": [
{
"url": "https://github.com/goodoneuz/pay-uz/blob/master/src/Http/Controllers/ApiController.php",
"source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"
},
{
"url": "https://github.com/goodoneuz/pay-uz/blob/master/src/routes/web.php",
"source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"
},
{
"url": "https://github.com/shaxzodbek-uzb/pay-uz",
"source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"
},
{
"url": "https://packagist.org/packages/goodoneuz/pay-uz",
"source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"
}
]
}