CVE-2025-34104

EIP tracks 1 public exploit for CVE-2025-34104. PoCs published by FireFart, including Metasploit module exploits/unix/webapp/piwik_superuser_plugin_upload.

AI-analyzed exploit summary This Metasploit module exploits a plugin upload vulnerability in Piwik (CVE-2025-34104) by authenticating as a superuser, generating a malicious plugin with embedded PHP payload, and uploading it to achieve remote code execution. It supports Piwik versions 2.x and 3.x (with manual config changes for 3.0.3+).

An authenticated remote code execution vulnerability exists in Piwik (now Matomo) versions prior to 3.0.3 via the plugin upload mechanism. In vulnerable versions, an authenticated user with Superuser privileges can upload and activate a malicious plugin (ZIP archive), leading to arbitrary PHP code execution on the underlying system. Starting with version 3.0.3, plugin upload functionality is disabled by default unless explicitly enabled in the configuration file.