CVE-2025-34104

Critical

Description

An authenticated remote code execution vulnerability exists in Piwik (now Matomo) versions prior to 3.0.3 via the plugin upload mechanism. In vulnerable versions, an authenticated user with Superuser privileges can upload and activate a malicious plugin (ZIP archive), leading to arbitrary PHP code execution on the underlying system. Starting with version 3.0.3, plugin upload functionality is disabled by default unless explicitly enabled in the configuration file.

SeverityCritical

CVSS9.4

Exploit probability—

ProductWeb Analytics Platform

PublishedJul 15, 2025

First seenJul 15, 2025

Weakness typeCWE-434Unrestricted upload of dangerous file type CWE-306Missing authentication for critical function

How to fix

Update

Piwik (now Matomo) Web Analytics Platform3.0.3 or later

Vendor advisories

matomo.org/changelog/piwik-3-0-3/

Affected products

Product	Affected versions	Fixed in
Piwik (now Matomo) Web Analytics Platform	v < 3.0.3	3.0.3

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.