---
id: "CVE-2026-124623"
page: "https://infrastack.ai/live/CVE-2026-124623"
kind: "vulnerability"
aliases: ["CVE-2026-124623"]
title: "PipraPay: system settings import accepts unrestricted file uploads remotely"
severity: "medium"
cvss: 5.8
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "PipraPay", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["other", "php", "pipraypay", "self-hosted"]
not_affected_if: ["unknown"]
published_at: "2026-11-09T13:17:07+00:00"
first_seen_at: "2026-11-09T13:26:51+00:00"
updated_at: "2026-11-09T13:27:43+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124623", "first_seen_at": "2026-11-09T13:26:51+00:00"}]
exploit_sources: []
---

# PipraPay: system settings import accepts unrestricted file uploads remotely

Link for people: https://infrastack.ai/live/CVE-2026-124623 (this .md is for agents)

PipraPay 3.0.0 has a flaw in its system-settings-import function that handles ZIP archives, allowing unrestricted file upload. The sources say an attacker can exploit it remotely and that a public exploit exists, so an attacker may be able to place files on the server.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:PipraPay affected range not listed fixed no fixed version listed

## How to check

- Check whether your installation runs PipraPay `3.0.0`, the version named in the sources.
- Look for the system-settings-import feature in the PipraPay admin area and confirm whether it is reachable from the internet.

## Timeline

- 2026-11-09T13:26:51+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124623

## From the sources

A security flaw has been discovered in PipraPay 3.0.0. Affected is the function system-settings-import of the file /sumo166/CVE-apply/blob/main/PipraPay/PipraPay/system-settings-import of the component ZIP Archive Handler. Performing a manipulation results in unrestricted upload. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_