CVE-2026-31843: goodoneuz/pay-uz: the /payment/api/editable/update endpoint overwrites existing PHP payment hook files

Severity: Critical

CVSS Score: 9.8

The goodoneuz/pay-uz Laravel package (<= 2.2.24) contains a critical vulnerability in the /payment/api/editable/update endpoint that allows unauthenticated attackers to overwrite existing PHP payment hook files. The endpoint is exposed via Route::any without authentication middleware, enabling remote access without credentials.