CVE-2026-31843

Name of the Vulnerable Software and Affected Versions goodoneuz/pay-uz versions prior to 2.2.25

Description A critical issue exists in the /payment/api/editable/update endpoint, which is exposed via Route::any() without authentication middleware. This allows unauthenticated remote attackers to overwrite existing PHP payment hook files by sending user-controlled input that is directly written into executable files using the file put contents() function. These modified files are subsequently executed via require() during standard payment processing workflows, leading to remote code execution (RCE), a state where an attacker can execute arbitrary commands on the server. The payment secret token does not provide mitigation for this specific endpoint.

Recommendations Update goodoneuz/pay-uz to a version newer than 2.2.24. As a temporary workaround, restrict access to the /payment/api/editable/update endpoint to minimize the risk of exploitation.