Paper/Archive/CVE-2025-34104

CVE-2025-34104

Piwik (now Matomo) Web Analytics Platform — Piwik Authenticated RCE via Custom Plugin Upload

CVSS 9.4 (CNA)9.4 / 10 × 3028.2 Not in CISA KEV+300.0 EPSS percentile 79.7.797 × 2015.9 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

An authenticated remote code execution vulnerability exists in Piwik (now Matomo) versions prior to 3.0.3 via the plugin upload mechanism. In vulnerable versions, an authenticated user with Superuser privileges can upload and activate a malicious plugin (ZIP archive), leading to arbitrary PHP code execution on the underlying system. Starting with version 3.0.3, plugin upload functionality is disabled by default unless explicitly enabled in the configuration file.

Affected

ProductAffectedFixed inSource

Web Analytics Platform< 3.0.33.0.3CNA

Scores by source

VulnCheck (CNA)9.4CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

advisorymatomo.org/changelog/piwik-3-0-3 refmatomo.org/faq/plugins/faq_21 writeupfirefart.at/post/turning_piwik_superuser_creds_into_rce exploitraw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/piwik_superuser_plugin_upload.rb writeupvulncheck.com/advisories/piwik-authenticated-rce-via-custom-plugin-upload