CVE-2026-31843: Goodoneuz Pay-Uz

Critical severity, CVSS 9.8. EPSS: 1.2% chance of exploitation in the next 30 days.

The goodoneuz/pay-uz Laravel package (<= 2.2.24) contains a critical vulnerability in the /payment/api/editable/update endpoint that allows unauthenticated attackers to overwrite existing PHP payment hook files. The endpoint is exposed via Route::any without authentication middleware, enabling remote access without credentials.

Affected products

• Goodoneuz Pay-Uz: up to and including 2.2.24

Published 2026-04-16. Last modified 2026-08-10.