CVE-2025-34104 Piwik Authenticated RCE via Custom Plugin Upload
Authenticated superusers can upload malicious plugins to execute arbitrary code, requiring configuration changes to disable the feature in newer versions.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-34104?
CVE-2025-34104 is a critical vulnerability in Piwik (now Matomo) Web Analytics Platform, published on 15 Jul 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
An authenticated remote code execution vulnerability exists in Piwik (now Matomo) versions prior to 3.0.3 via the plugin upload mechanism. In vulnerable versions, an authenticated user with Superuser privileges can upload and activate a malicious plugin (ZIP archive), leading to arbitrary PHP code execution on the underlying system. Starting with version 3.0.3, plugin upload functionality is disabled by default unless explicitly enabled in the configuration file.
Which versions are affected by CVE-2025-34104?
How do I fix CVE-2025-34104?
No fix has been published for CVE-2025-34104 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-34104 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-34104 exists.
Public exploit code: 1 Metasploit module.
Sources
Also known as GHSA-7p5r-mwrp-qhhq.