CVE-2025-34097: ProcessMaker < 3.5.4 Authenticated Plugin Upload RCE
An unrestricted file upload vulnerability exists in ProcessMaker versions prior to 3.5.4 due to improper handling of uploaded plugin archives. An attacker with administrative privileges can upload a malicious .tar plugin file containing arbitrary PHP code. Upon installation, the plugin’s install() method is invoked, resulting in execution of attacker-supplied PHP code on the server with the privileges of the web server user. This vulnerability can be chained with CVE-2022-38577 — a privilege escalation flaw in the user profile page — to achieve full remote code execution from a low-privileged account.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-34097?
CVE-2025-34097 is considered to have a critical severity level due to the potential for arbitrary code execution.
How do I fix CVE-2025-34097?
To fix CVE-2025-34097, upgrade ProcessMaker to version 3.5.4 or later.
What type of vulnerability is CVE-2025-34097?
CVE-2025-34097 is an unrestricted file upload vulnerability.
Who can exploit CVE-2025-34097?
An attacker with administrative privileges can exploit CVE-2025-34097 to upload malicious files.
What are the risks associated with CVE-2025-34097?
The risks include the potential for remote code execution and unauthorized access to the affected system.