Vulnerability · Published Jul 15, 2025 · Assigned by VulnCheck

CVE-2025-34104Piwik Authenticated RCE via Custom Plugin Upload

Critical 9.4

In plain English

A critical-severity unrestricted file upload in Web Analytics Platform from Piwik (now Matomo). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.9% (higher than 80% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit.

Severity (CVSS 4.0)9.4Critical

Exploit odds (30 days)1.9%top 20.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Metasploit

Official description

An authenticated remote code execution vulnerability exists in Piwik (now Matomo) versions prior to 3.0.3 via the plugin upload mechanism. In vulnerable versions, an authenticated user with Superuser privileges can upload and activate a malicious plugin (ZIP archive), leading to arbitrary PHP code execution on the underlying system. Starting with version 3.0.3, plugin upload functionality is disabled by default unless explicitly enabled in the configuration file.

Affected products (as reported)

Vendor	Product	Versions
Piwik (now Matomo)	Web Analytics Platform	0 – before 3.0.3

Weakness: CWE-434, CWE-306 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

References

https://matomo.org/changelog/piwik-3-0-3/ vendor-advisory
https://matomo.org/faq/plugins/faq_21/ product
https://firefart.at/post/turning_piwik_superuser_creds_into_rce/ third-party-advisory
https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/piwik_superuser_plugin_upload.rb exploit
https://www.vulncheck.com/advisories/piwik-authenticated-rce-via-custom-plugin-upload third-party-advisory