CVE-2026-124623: PipraPay ZIP Archive system-settings-import unrestricted upload
A security flaw has been discovered in PipraPay 3.0.0. Affected is the function system-settings-import of the file /sumo166/CVE-apply/blob/main/PipraPay/PipraPay/system-settings-import of the component ZIP Archive Handler. Performing a manipulation results in unrestricted upload. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The vulnerability is remotely exploitable with low attack complexity, but the supplied CVSS vector indicates that the attacker needs high privileges. No user interaction is required.
Is public exploit code available?
Yes. The vulnerability is flagged as having a proof of concept, and the description states that an exploit has been publicly released.
What is the likely impact if exploitation succeeds?
The reported impact includes low-level effects on confidentiality, integrity, and availability. The flaw allows unrestricted upload through the ZIP Archive Handler's system-settings-import functionality.
Is a vendor fix available?
The provided information does not identify a fix. It states that the project was notified through an issue report but had not responded at the time of reporting.