CVE-2025-34104

Description

An authenticated remote code execution vulnerability exists in Piwik (now Matomo) versions prior to 3.0.3 via the plugin upload mechanism. In vulnerable versions, an authenticated user with Superuser privileges can upload and activate a malicious plugin (ZIP archive), leading to arbitrary PHP code execution on the underlying system. Starting with version 3.0.3, plugin upload functionality is disabled by default unless explicitly enabled in the configuration file.

Reserved 2025-04-15 | Published 2025-07-15 | Updated 2025-07-15 | Assigner VulnCheck

Problem types

CWE-434 Unrestricted Upload of File with Dangerous Type

CWE-306 Missing Authentication for Critical Function

Product status

Default status
unaffected

* before 3.0.3
affected

Credits

FireFart finder

References

matomo.org/changelog/piwik-3-0-3/ vendor-advisory

matomo.org/faq/plugins/faq_21/ product

firefart.at/post/turning_piwik_superuser_creds_into_rce/ third-party-advisory

raw.githubusercontent.com/...iwik_superuser_plugin_upload.rb exploit

www.vulncheck.com/...henticated-rce-via-custom-plugin-upload third-party-advisory

cve.org (CVE-2025-34104)

nvd.nist.gov (CVE-2025-34104)

Download JSON