CVE-2026-31843 Details

A critical remote code execution vulnerability has been identified in the Goodoneuz Pay-uz Laravel package, specifically in versions through 2.2.24. The issue arises in the '/payment/api/editable/update' endpoint, which is accessible without authentication. This endpoint allows unauthenticated attackers to overwrite existing PHP payment hook files. The vulnerability is exploited by sending user-controlled input that is directly written into executable PHP files using 'file_put_contents()'. These modified files are then executed via 'require()' during regular payment processing, leading to remote code execution under the default application behavior. Notably, the payment secret token referenced by the vendor does not mitigate this vulnerability.