CVE-2025-34104CWE-306CWE-434

Piwik Authenticated RCE via Custom Plugin Upload

Critical · published July 15, 2025

CVSS v4.0
9.4
EPSS
2%
Percentile
79.6
In the wild
Unconfirmed
What it is

An authenticated remote code execution vulnerability exists in Piwik (now Matomo) versions prior to 3.0.3 via the plugin upload mechanism. In vulnerable versions, an authenticated user with Superuser privileges can upload and activate a malicious plugin (ZIP archive), leading to arbitrary PHP code execution on the underlying system. Starting with version 3.0.3, plugin upload functionality is disabled by default unless explicitly enabled in the configuration file.

The record
Technical detail
CVSS v4.0
9.4 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
EPSS
0.01906 · 79.6th percentile
Weaknesses
CWE-306 · Missing Authentication for Critical Function; CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2025-07-15T13:06Z
EPSS history
Timeline
  • 15 JUL 13:06Z
    Piwik Authenticated RCE via Custom Plugin Upload
    cvelistv5