PIPRAPAY · CVE-2026-124623 · Other
NO FIX YET
PipraPay 3.0.0 has a flaw in its system-settings-import function that handles ZIP archives, allowing unrestricted file upload. The sources say an attacker can exploit it remotely and that a public exploit exists, so an attacker may be able to place files on the server.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
PipraPay 3.0.0 installations that expose the system settings import feature, where ZIP archives uploaded through that function are not restricted. The sources do not say which configurations are safe, and they do not name a fixed version. The project had not responded to the early report when the sources were written.
Not affected if unknown
Who cares php, pipraypay, self-hosted
3.0.0, the version named in the sources.No fix yet, per the sources.
A security flaw has been discovered in PipraPay 3.0.0. Affected is the function system-settings-import of the file /sumo166/CVE-apply/blob/main/PipraPay/PipraPay/system-settings-import of the component ZIP Archive Handler. Performing a manipulation results in unrestricted upload. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.