PT-2026-33312 · Packagist · Pay-Uz

Published 2026-04-16 · Updated 2026-04-18 · CVE-2026-31843

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions pay-uz versions prior to 2.2.25

Description The pay-uz Laravel package contains a flaw in the '/payment/api/editable/update' endpoint. This endpoint is exposed via Route::any() without authentication middleware, allowing unauthenticated remote access. User-controlled input is written directly into executable PHP payment hook files using the file put contents() function. These files are subsequently executed via the require() function during standard payment processing, which can lead to remote code execution.

Recommendations Update to a version later than 2.2.24. As a temporary workaround, restrict access to the '/payment/api/editable/update' endpoint to minimize the risk of exploitation.

Fix

RCE

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2026-31843

GHSA-M5WG-CJGH-223J

Affected Products

Pay-Uz

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2026-31843 · Security Note
• https://osv.dev/vulnerability/GHSA-m5wg-cjgh-223j · Vendor Advisory
• https://github.com/goodoneuz/pay-uz/blob/master/src/routes/web.php · Note
• https://github.com/shaxzodbek-uzb/pay-uz · Note
• https://github.com/goodoneuz/pay-uz/blob/master/src/Http/Controllers/ApiController.php · Note
• https://twitter.com/infoflowcloud/status/2045105210901553378 · Twitter Post
• https://twitter.com/CVEnew/status/2045102684441632845 · Twitter Post
• https://twitter.com/pulsepatchio/status/2045334511123091897 · Twitter Post
• https://twitter.com/ctiwatchcloud/status/2045110048632823971 · Twitter Post
• https://packagist.org/packages/goodoneuz/pay-uz · Note
• https://twitter.com/0dayPublishing/status/2044768964048191758 · Twitter Post
• https://twitter.com/TuringCyberObs/status/2045126376718500112 · Twitter Post