CVE-2025-34097

🗓️ 10 Jul 2025 19:12:37Reported by VulnCheckType

cve🔗 web.nvd.nist.gov👁 35 Views🌐 WEB

Unrestricted file upload in ProcessMaker < 3.5.4 allows RCE via malicious plugin archives.

Reporter	Title	Published	Views	Family All 10
Circl	CVE-2025-34097	29 May 201815:50	–	circl
CNNVD	ProcessMaker 代码问题漏洞	10 Jul 202500:00	–	cnnvd
Cvelist	CVE-2025-34097 ProcessMaker < 3.5.4 Authenticated Plugin Upload RCE	10 Jul 202519:12	–	cvelist
EUVD	EUVD-2025-21034	3 Oct 202520:07	–	euvd
Metasploit	ProcessMaker Plugin Upload	25 Aug 201000:00	–	metasploit
NVD	CVE-2025-34097	10 Jul 202520:15	–	nvd
Positive Technologies	PT-2025-29139 · Unknown · Processmaker	10 Jul 202500:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2025-34097: Unrestricted Upload of File with Dangerous Type	10 Jul 202500:00	–	rapid7
RedhatCVE	CVE-2025-34097	12 Jul 202519:24	–	redhatcve
Vulnrichment	CVE-2025-34097 ProcessMaker < 3.5.4 Authenticated Plugin Upload RCE	10 Jul 202519:12	–	vulnrichment

Vulners

CNA

Node

processmaker processmakerRange0–3.5.4

[
  {
    "defaultStatus": "unaffected",
    "modules": [
      "/setup/pluginsImportFile",
      "form[PLUGIN_FILENAME]"
    ],
    "product": "ProcessMaker",
    "vendor": "ProcessMaker Inc.",
    "versions": [
      {
        "lessThan": "3.5.4",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
process-maker-authenticated-plugin-upload-rce	www.process-maker-authenticated-plugin-upload-rce/
fortiguard	www.fortiguard.com/encyclopedia/ips/45757
exploit-db	www.exploit-db.com/exploits/44399
wiki	www.wiki.processmaker.net/3.0/Plugin_Development
raw	www.raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/processmaker_plugin_upload.rb
vulncheck	www.vulncheck.com/advisories/process-maker-authenticated-plugin-upload-rce

Parameter	Position	Path	Description	CWE
form[PLUGIN_FILENAME]	request body	/sysworkflow/en/neoclassic/setup/pluginsImportFile	Upload endpoint for the plugin tar; the installed plugin's install() is executed, enabling remote code execution via attacker-supplied PHP.	CWE-434
pluginUid	request body	/sysworkflow/en/neoclassic/setup/pluginsRemove	Endpoint to remove a plugin (cleanup); used in exploitation workflow.	CWE-434

17 Jun 2026 09:13Current

9.2Critical risk

Vulners AI Score9.2

CVSS 48.6

EPSS0.01603

SSVC

CWE-434