Piwik Authenticated RCE via Custom Plugin Upload

published 2025-07-15 15 mo ago modified 2026-07-14 3 mo ago also EUVD-2025-21429

cvss: 9.4; version 4.0, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 1.9%; EPSS 1.9% chance of exploitation in 30 days, percentile 79%
public exploits: 1; Metasploit

An authenticated remote code execution vulnerability exists in Piwik (now Matomo) versions prior to 3.0.3 via the plugin upload mechanism. In vulnerable versions, an authenticated user with Superuser privileges can upload and activate a malicious plugin (ZIP archive), leading to arbitrary PHP code execution on the underlying system. Starting with version 3.0.3, plugin upload functionality is disabled by default unless explicitly enabled in the configuration file.

Patch / fix

fixed in 1

Piwik (now Matomo) Web Analytics Platform 3.0.3

Timeline

2017-02-05 First public exploit (Metasploit exploit/unix/webapp/piwik_superuser_plugin_upload)
2025-07-15 Published

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: total
Assessed: 15 mo ago (2025-07-15)

Exploit prediction

1.91% chance of exploitation in the next 30 days, higher than 79% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

Metasploit exploit/unix/webapp/piwik_superuser_plugin_upload Piwik Superuser Plugin Upload metasploit exploit, excellent rank, 2017-02-05
raw.githubusercontent.com https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/webapp/piwik_superuser_plugin_upload.rb referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	4.0	9.4	CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CNA	4.0	9.4	CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

Piwik (now Matomo) Web Analytics Platform

Classification

Weakness

CWE-434 Unrestricted Upload of File with Dangerous Type
CWE-306 Missing Authentication for Critical Functionality

References

raw.githubusercontent.com /rapid7/metasploit-framework/master/modules/exploits/unix/webapp/piwik_superuser_plugin_upload.rb
exploit
matomo.org /changelog/piwik-3-0-3/
vendor-advisory
matomo.org /faq/plugins/faq_21/
product
firefart.at /post/turning_piwik_superuser_creds_into_rce/
third-party-advisory
vulncheck.com /advisories/piwik-authenticated-rce-via-custom-plugin-upload
third-party-advisory

Sources

CVE List CVE-2025-34104
NVD CVE-2025-34104

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary