CVE-2025-34104 CRITICAL

CVE-2025-34104: Piwik Authenticated RCE via Custom Plugin Upload

Vendor Piwik (Now Matomo)
Product Web Analytics Platform
Weakness CWE-434 · Unrestricted file upload
Published July 15, 2025
Last update May 15, 2026
View on NVD All CVEs

CVSS base score

9.4/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

What the vulnerability does

01Description

An authenticated remote code execution vulnerability exists in Piwik (now Matomo) versions prior to 3.0.3 via the plugin upload mechanism. In vulnerable versions, an authenticated user with Superuser privileges can upload and activate a malicious plugin (ZIP archive), leading to arbitrary PHP code execution on the underlying system. Starting with version 3.0.3, plugin upload functionality is disabled by default unless explicitly enabled in the configuration file.

Key dates

02Disclosure timeline

July 15, 2025 CVE published
May 15, 2026 Record updated