Which versions of pay-uz are affected by CVE-2026-31843?

Any web-facing application using goodoneuz/pay-uz Laravel package through version 2.2.24 can be remotely compromised without credentials, allowing attackers to inject malicious code directly into…. A patch is available.

How to fix or mitigate CVE-2026-31843?

Within 24 hours, identify all applications using goodoneuz/pay-uz package through version 2.2.24 and immediately isolate affected payment systems from direct internet access or place them behind a Web Application Firewall to block requests to /payment/api/editable/update. Within 7 days, conduct a security audit to detect any prior compromise of payment-hook files, evaluate alternative payment processors as interim replacements, and document all affected systems with their current package versions. Within 30 days, complete migration to an alternative Laravel payment package with documented security review, or implement and harden compensating technical controls if replacement is not immediately feasible.

pay-uz CVE-2026-31843

Q: What is the CVSS score of CVE-2026-31843?

CVE-2026-31843 has a CVSS 4.0 base score of 10.0 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.9%.

EUVD-2026-23225 CRITICAL

Improper Access Control (CWE-284)

2026-04-16 TuranSec

GHSA-m5wg-cjgh-223j

PHP Authentication Bypass RCE Pay Uz

10.0

CVSS 4.0 · Vendor: TuranSec

Severity by source

Vendor (TuranSec) PRIMARY

10.0 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Unauthenticated network endpoint with no user interaction and low complexity (PR:N/UI:N/AC:L); arbitrary PHP execution yields full C/I/A within the application authority, so S:U.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (TuranSec).

CVSS VectorVendor: TuranSec

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 07:41 vuln.today

CVSS changed

Apr 16, 2026 - 13:22 NVD

9.8 (CRITICAL) 10.0 (CRITICAL)

EUVD ID Assigned

Apr 16, 2026 - 13:15 euvd

EUVD-2026-23225

CVE Published

Apr 16, 2026 - 13:02 nvd

CRITICAL 10.0

DescriptionCVE.org

The goodoneuz/pay-uz Laravel package (<= 2.2.24) contains a critical vulnerability in the /payment/api/editable/update endpoint that allows unauthenticated attackers to overwrite existing PHP payment hook files. The endpoint is exposed via Route::any() without authentication middleware, enabling remote access without credentials. User-controlled input is directly written into executable PHP files using file_put_contents(). These files are later executed via require() during normal payment processing workflows, resulting in remote code execution under default application behavior. The payment secret token mentioned by the vendor is unrelated to this endpoint and does not mitigate the vulnerability.

AnalysisAI

Unauthenticated remote code execution in the goodoneuz/pay-uz Laravel package (all versions through 2.2.24) lets remote attackers overwrite executable PHP payment-hook files through the /payment/api/editable/update endpoint, which is registered via Route::any() with no authentication middleware. User-supplied content is written verbatim with file_put_contents() into PHP files that are later loaded via require() during normal payment processing, so any web-facing deployment can be fully compromised without credentials. CVSS is 10.0 and SSVC rates technical impact as total and the attack as automatable; there is no public exploit identified at time of analysis and EPSS is a modest 0.89% (75th percentile).

Technical ContextAI

pay-uz is a PHP/Laravel Composer package (distributed via Packagist) that integrates Uzbek payment gateways into Laravel applications. The vulnerability class is CWE-284 (Improper Access Control): the /payment/api/editable/update route is declared in src/routes/web.php with Route::any(), meaning it responds to every HTTP method and is deliberately excluded from any auth or CSRF guard. The handling logic in src/Http/Controllers/ApiController.php takes attacker-controlled request data and passes it straight to file_put_contents() targeting on-disk PHP 'hook' files. Because Laravel later includes those same files with require() as part of the payment workflow, the write primitive is promoted to arbitrary PHP execution - a classic untrusted-file-write-to-include chain. The vendor-referenced payment secret token protects other endpoints and is not checked on this route, so it provides no mitigation.

RemediationAI

No vendor-released patch or fixed version is identified at time of analysis - the advisory marks pay-uz through 2.2.24 as vulnerable without naming a corrected release, so monitor Packagist (https://packagist.org/packages/goodoneuz/pay-uz) and the upstream repo for a tagged fix and upgrade as soon as one ships. Until then, apply specific compensating controls: block or remove the /payment/api/editable/update route entirely (or place an authentication/authorization middleware and a method allowlist in front of it in your Laravel route definitions), which stops the write primitive at the cost of disabling the editable-hook feature; make the payment hook directory and its PHP files non-writable by the web/PHP-FPM user so file_put_contents() fails, accepting that legitimate hook editing will break; and add a WAF or reverse-proxy rule denying external access to /payment/api/editable/* so only trusted internal callers reach it. Cross-check with the vendor advisories at https://nvd.nist.gov/vuln/detail/CVE-2026-31843 and https://vuldb.com/vuln/357915.