CVE-2026-31843 goodoneuz/pay-uz Unauthenticated PHP File Overwrite via /payment/api/editable/update Leading to Remote Code Execution
Unauthenticated attackers can overwrite PHP files via an unprotected API endpoint, leading to remote code execution in the pay-uz Laravel package.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-31843?
CVE-2026-31843 is a critical missing authorization vulnerability in goodoneuz pay-uz, published on 16 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The goodoneuz/pay-uz Laravel package (<= 2.2.24) contains a critical vulnerability in the /payment/api/editable/update endpoint that allows unauthenticated attackers to overwrite existing PHP payment hook files. The endpoint is exposed via Route::any without authentication middleware, enabling remote access without credentials.
Weakness: CWE-284
Which versions are affected by CVE-2026-31843?
2 open source packages ship an affected version, including goodoneuz/pay-uz.
| Package | Affected | Fixed in |
|---|---|---|
goodoneuz/pay-uz Packagist | All versions | 3.0.0 |
goodoneuz/pay-uz Packagist | All versions | 3.0.0 |
How do I fix CVE-2026-31843?
Upgrade goodoneuz/pay-uz to 3.0.0 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-31843 being exploited?
There is no known exploitation of CVE-2026-31843 in the wild and no public exploit code.
Sources
Also known as GHSA-m5wg-cjgh-223j.