Detections
Analytics
SCA: security update for goodoneuz/pay-uz (GHSA-m5wg-cjgh-223j)
critical Tenable Self-Hosted Container Security Plugin ID 445385
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- The goodoneuz/pay-uz Laravel package (<= 2.2.24) contains a critical vulnerability in the
/payment/api/editable/update endpoint that allows unauthenticated attackers to overwrite existing PHP
payment hook files. The endpoint is exposed via Route::any() without authentication middleware, enabling
remote access without credentials. User-controlled input is directly written into executable PHP files
using file_put_contents(). These files are later executed via require() during normal payment processing
workflows, resulting in remote code execution under default application behavior. The payment secret token
mentioned by the vendor is unrelated to this endpoint and does not mitigate the vulnerability.
(CVE-2026-31843)
Solution
Update the goodoneuz/pay-uz library and its related packages to version 3.0.0 or later.See Also
Plugin Details
Severity: Critical
ID: 445385
Version: Revision 1.1
Type: Local
Family: SCA Checks
Published: 7/28/2026
Updated: 7/28/2026
Risk Information
VPR
Risk Factor: High
Score: 7.7
Percentile: 99.04
Vendor
Vendor Severity: Critical
CVSS v2
Risk Factor: Critical
Base Score: 10
Temporal Score: 7.4
Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C
CVSS Score Source: CVE-2026-31843
CVSS v3
Risk Factor: Critical
Base Score: 9.8
Temporal Score: 8.5
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
CVSS v4
Risk Factor: Critical
Base Score: 10
Threat Score: 9.1
Threat Vector: CVSS:4.0/E:U
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 4/16/2026
Vulnerability Publication Date: 4/16/2026
Reference Information
CVE: CVE-2026-31843
cwe: CWE-284