THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-31843 (CRITICAL 9.8) — The goodoneuz/pay-uz Laravel package (<= 2.2.24) contains a critical vulnerability in the /payment/api/editable/update endpoint that allows unauthenticated attackers to overwrite existing PHP payment hook files. The endpoint is exposed via Route::any without authentication middle

[NVD] CVE-2026-31843 (CRITICAL 9.8) — The goodoneuz/pay-uz Laravel package (<= 2.2.24) contains a critical vulnerability in the /payment/api/editable/update endpoint that allows unauthenticated attackers to overwrite existing PHP payment hook files. The endpoint is exposed via Route::any without authentication middle

lownvdPublished 2026-04-16

CVE-2026-31843 CVSS: 9.8 CRITICAL Published: 2026-04-16T13:16:48.473

The goodoneuz/pay-uz Laravel package (<= 2.2.24) contains a critical vulnerability in the /payment/api/editable/update endpoint that allows unauthenticated attackers to overwrite existing PHP payment hook files. The endpoint is exposed via Route::any without authentication middleware, enabling remote access without credentials.

MITRE ATT&CK techniques

CredentialsT1589.001

Indicators of compromise

CVE-2026-31843cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-31843