CVE-2025-34104: critical vulnerability in Piwik (now Matomo) Web Analytics Platform
Piwik Authenticated RCE via Custom Plugin Upload
Published · Updated
43Vexday Risk Score
Patch soon. It has a working public exploit.
ssvc Attendcvss 9.4epss 1.8%
from disclosure to weapon0 days
Published on NVDJul 15
metasploitFeb 5
exploitation probability
1.8%top 22% of all CVEs
observed exploitation
nono source reports it
An authenticated remote code execution vulnerability exists in Piwik (now Matomo) versions prior to 3.0.3 via the plugin upload mechanism. In vulnerable versions, an authenticated user with Superuser privileges can upload and activate a malicious plugin (ZIP archive), leading to arbitrary PHP code execution on the underlying system. Starting with version 3.0.3, plugin upload functionality is disabled by default unless explicitly enabled in the configuration file.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Affected products
Piwik (now Matomo) · Web Analytics PlatformReferences
https://firefart.at/post/turning_piwik_superuser_creds_into_rce/https://matomo.org/changelog/piwik-3-0-3/https://matomo.org/faq/plugins/faq_21/https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/piwik_superuser_plugin_upload.rbhttps://www.vulncheck.com/advisories/piwik-authenticated-rce-via-custom-plugin-upload