{"id":"CVE-2026-124623","kind":"vulnerability","aliases":["CVE-2026-124623"],"related":[],"title":"PipraPay: system settings import accepts unrestricted file uploads remotely","description":"A security flaw has been discovered in PipraPay 3.0.0. Affected is the function system-settings-import of the file /sumo166/CVE-apply/blob/main/PipraPay/PipraPay/system-settings-import of the component ZIP Archive Handler. Performing a manipulation results in unrestricted upload. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.","summary":"PipraPay 3.0.0 has a flaw in its system-settings-import function that handles ZIP archives, allowing unrestricted file upload. The sources say an attacker can exploit it remotely and that a public exploit exists, so an attacker may be able to place files on the server.","severity":"medium","cvss":5.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"PipraPay","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["other","php","pipraypay","self-hosted"],"not_affected_if":["unknown"],"how_to_check":"- Check whether your installation runs PipraPay `3.0.0`, the version named in the sources.\n- Look for the system-settings-import feature in the PipraPay admin area and confirm whether it is reachable from the internet.","fix":null,"status":"open","published_at":"2026-11-09T13:17:07+00:00","first_seen_at":"2026-11-09T13:26:51+00:00","triaged_at":"2026-11-09T13:27:43+00:00","updated_at":"2026-11-09T13:27:43+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-09T13:27:43Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"PipraPay: system settings import accepts unrestricted file uploads remotely","impact":"high","summary":"PipraPay 3.0.0 has a flaw in its system-settings-import function that handles ZIP archives, allowing unrestricted file upload. The sources say an attacker can exploit it remotely and that a public exploit exists, so an attacker may be able to place files on the server.","audience":"businesses","category":"other","nicknames":[],"who_cares":["pipraypay","php","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker uploads arbitrary files to the server","analyst_note":"Check the vendor or project page for a fix, and confirm whether the upload is restricted to admin users and what file types the server accepts.","how_to_check":"- Check whether your installation runs PipraPay `3.0.0`, the version named in the sources.\n- Look for the system-settings-import feature in the PipraPay admin area and confirm whether it is reachable from the internet.","plain_action":"","product_name":"PipraPay","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"PipraPay 3.0.0 installations that expose the system settings import feature, where ZIP archives uploaded through that function are not restricted. The sources do not say which configurations are safe, and they do not name a fixed version. The project had not responded to the early report when the sources were written.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00074,"input_tokens":4601,"output_tokens":559,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-124623':12A,15A '-2026':11A,14A '/sumo166/cve-apply/blob/main/piprapay/piprapay/system-settings-import':90C '3.0.0':24B,78C 'abl':63B 'accept':5A 'affect':79C 'allow':39B 'archiv':38B,95C 'attack':47B,60B,105C,126C 'carri':110C 'compon':93C 'cve':10A,13A 'discov':75C 'earli':134C 'exist':57B 'exploit':49B,56B,114C 'file':7A,41B,66B,89C 'flaw':27B,72C 'function':34B,82C 'handl':36B 'handler':96C 'host':22B 'import':4A,33B,86C 'inform':130C 'issu':137C 'manipul':99C 'may':61B,122C 'perform':97C 'php':18B 'piprapay':1A,16A,23B,77C 'pipraypay':19B 'place':65B 'possibl':107C 'problem':133C 'project':128C 'public':55B,120C 'releas':117C 'remot':9A,51B,112C 'report':138C 'respond':142C 'result':100C 'say':45B 'secur':71C 'self':21B 'self-host':20B 'server':69B 'set':3A,32B,85C 'sourc':44B 'system':2A,31B,84C 'system-settings-import':30B,83C 'unrestrict':6A,40B,102C 'upload':8A,42B,103C 'use':124C 'yet':143C 'zip':37B,94C","nicknames":[],"mitigations":[],"who_affected":"PipraPay 3.0.0 installations that expose the system settings import feature, where ZIP archives uploaded through that function are not restricted. The sources do not say which configurations are safe, and they do not name a fixed version. The project had not responded to the early report when the sources were written.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["piprapay"],"ptokens":["piprapay"],"labels":["medium","other","php","pipraypay","selfhosted","vendor"],"campaign_type":null,"search_a":"'-124623':12A,15A '-2026':11A,14A 'accept':5A 'cve':10A,13A 'file':7A 'import':4A 'piprapay':1A,16A 'remot':9A 'set':3A 'system':2A 'unrestrict':6A 'upload':8A","search_b":"'3.0.0':24B 'abl':63B 'allow':39B 'archiv':38B 'attack':47B,60B 'exist':57B 'exploit':49B,56B 'file':41B,66B 'flaw':27B 'function':34B 'handl':36B 'host':22B 'import':33B 'may':61B 'php':18B 'piprapay':23B 'pipraypay':19B 'place':65B 'public':55B 'remot':51B 'say':45B 'self':21B 'self-host':20B 'server':69B 'set':32B 'sourc':44B 'system':31B 'system-settings-import':30B 'unrestrict':40B 'upload':42B 'zip':37B","search_c":"'/sumo166/cve-apply/blob/main/piprapay/piprapay/system-settings-import':90C '3.0.0':78C 'affect':79C 'archiv':95C 'attack':105C,126C 'carri':110C 'compon':93C 'discov':75C 'earli':134C 'exploit':114C 'file':89C 'flaw':72C 'function':82C 'handler':96C 'import':86C 'inform':130C 'issu':137C 'manipul':99C 'may':122C 'perform':97C 'piprapay':77C 'possibl':107C 'problem':133C 'project':128C 'public':120C 'releas':117C 'remot':112C 'report':138C 'respond':142C 'result':100C 'secur':71C 'set':85C 'system':84C 'system-settings-import':83C 'unrestrict':102C 'upload':103C 'use':124C 'yet':143C 'zip':94C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T13:17:07+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124623","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124623","severity":null,"published_at":"2026-11-09T13:17:07+00:00","modified_at":"2026-11-09T13:17:08+00:00","first_seen_at":"2026-11-09T13:26:51+00:00","fetched_at":"2026-11-09T13:26:51+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}