What’s Vulnerable › Vulnerabilities

CVE-2025-34104: Piwik Authenticated RCE via Custom Plugin Upload

• Severity: critical (CVSS 9.4 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-07-15 · updated 2026-06-17
• Weakness: CWE-306

Description

An authenticated remote code execution vulnerability exists in Piwik (now Matomo) versions prior to 3.0.3 via the plugin upload mechanism. In vulnerable versions, an authenticated user with Superuser privileges can upload and activate a malicious plugin (ZIP archive), leading to arbitrary PHP code execution on the underlying system. Starting with version 3.0.3, plugin upload functionality is disabled by default unless explicitly enabled in the configuration file.

Affected products

• Piwik (now Matomo) Web Analytics Platform: before 3.0.3 — fixed in 3.0.3

How to fix

Upgrade to a fixed version: Piwik (now Matomo) Web Analytics Platform 3.0.3. Check the vendor advisory for mitigations.

References

• https://firefart.at/post/turning_piwik_superuser_creds_into_rce/
• https://matomo.org/changelog/piwik-3-0-3/
• https://matomo.org/faq/plugins/faq_21/
• https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/piwik_superuser_plugin_upload.rb
• https://www.vulncheck.com/advisories/piwik-authenticated-rce-via-custom-plugin-upload

Get alerted when CVE-2025-34104 or the next vulnerability affects your stack