The goodoneuz/pay-uz Laravel package (versions 2.2.24 and earlier) contains a critical flaw in the /payment/api/editable/update endpoint. This route is declared with Route::any and lacks authentication middleware, allowing unauthenticated attackers to call the endpoint. The endpoint accepts PHP code and writes it to existing payment hook files, effectively overwriting those files with attacker supplied code. This permits arbitrary PHP execution on the server, compromising confidentiality, integrity, and availability of the application and potentially the underlying host.

All installations that rely on the goodoneuz/pay-uz package at version 2.2.24 or earlier are affected. The provided references point to the package source files that implement the vulnerable endpoint, and no other versions are listed. If a deployment uses a newer version of the package, further review is required to confirm whether the flaw persists.

The CVSS score of 10.0 reflects remote code execution with no authentication. An EPSS score of 1% indicates a low‑but‑nonzero chance of exploitation. The flaw is not currently listed in the CISA KEV catalog. Attackers can trigger the vulnerability by sending an unauthenticated request to the exposed endpoint with a malicious PHP payload; the lack of authentication and input validation creates a straightforward exploit path. The likely attack vector is remote HTTP requests to the endpoint, inferred from the Route::any() usage without middleware.