CVE-2025-34104: Piwik Authenticated RCE via Custom Plugin Upload
An authenticated remote code execution vulnerability exists in Piwik (now Matomo) versions prior to 3.0.3 via the plugin upload mechanism. In vulnerable versions, an authenticated user with Superuser privileges can upload and activate a malicious plugin (ZIP archive), leading to arbitrary PHP code execution on the underlying system. Starting with version 3.0.3, plugin upload functionality is disabled by default unless explicitly enabled in the configuration file.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Piwik (Matomo)to a version that resolves this vulnerability.Fixed in 3.0.3 - Configuration
Ensure plugin upload is disabled; enable it only if explicitly required by updating the configuration accordingly.
Piwik (Matomo) plugin upload mechanism plugin upload functionality = disabled by default unless explicitly enabled
Event History
Frequently Asked Questions
What is the severity of CVE-2025-34104?
CVE-2025-34104 is categorized as a critical severity vulnerability due to its potential to enable remote code execution by authenticated superusers.
How do I fix CVE-2025-34104?
To fix CVE-2025-34104, upgrade your Matomo Piwik installation to version 3.0.3 or later.
Who is affected by CVE-2025-34104?
CVE-2025-34104 affects all Matomo Piwik installations prior to version 3.0.3.
What type of attack does CVE-2025-34104 enable?
CVE-2025-34104 enables authenticated remote code execution attacks via the plugin upload mechanism.
What privileges are required to exploit CVE-2025-34104?
Exploitation of CVE-2025-34104 requires an authenticated user to have Superuser privileges.