Piwik Authenticated RCE via Custom Plugin Upload
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass, Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-306 and CWE-434.
Summary
An authenticated remote code execution vulnerability exists in Piwik (now Matomo) versions prior to 3.0.3 via the plugin upload mechanism. In vulnerable versions, an authenticated user with Superuser privileges can upload and activate a malicious plugin (ZIP archive), leading to arbitrary PHP code execution on the underlying system. Starting with version 3.0.3, plugin upload functionality is disabled by default unless explicitly enabled in the configuration file.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Piwik (now Matomo) | Web Analytics Platform | before 3.0.3 | 3.0.3 | Patch available | CNA |
- Web Analytics Platform VendorPiwik (now Matomo) Affected before 3.0.3 Fixed in 3.0.3 Patch available CNA
Remediation
- Fix · CNA Web Analytics Platform (Piwik (now Matomo)) Fixed in 3.0.3
Timeline
- 2026-10-02 Threatist record created from CVE-2025-34104
- 2026-10-03 Alias added: GHSA-7p5r-mwrp-qhhq
References
Sources
- CVE-2025-34104 · CVE Program
- CVE-2025-34104 · NVD
- FIRST EPSS
- GHSA-7p5r-mwrp-qhhq · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences