CVE-2026-31843
CriticalCVSS 9.8Exploitation Probability (EPSS)
High risk85th percentile - higher than 85% of all known CVEs
Summary
Critical vulnerability in the goodoneuz/pay-uz Laravel package (<= 2.2.24) in the /payment/api/editable/update endpoint. It allows unauthenticated attackers to overwrite existing PHP payment hook files.
Risk Assessment
An unauthenticated attacker can remotely modify hook files, potentially leading to application takeover or arbitrary code execution.
Recommendation
Update the package to a version newer than 2.2.24 or apply mitigations such as adding authentication to the endpoint.
Original NVD description (English source)
The goodoneuz/pay-uz Laravel package (<= 2.2.24) contains a critical vulnerability in the /payment/api/editable/update endpoint that allows unauthenticated attackers to overwrite existing PHP payment hook files. The endpoint is exposed via Route::any without authentication middleware, enabling remote access without credentials.