Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
2 vulnerabilities found for ProcessMaker by ProcessMaker Inc.
CVE-2025-34097 (GCVE-0-2025-34097)
Vulnerability from cvelistv5 – Published: 2025-07-10 19:12 – Updated: 2026-05-15 11:14
VLAI
Title
ProcessMaker < 3.5.4 Authenticated Plugin Upload RCE
Summary
An unrestricted file upload vulnerability exists in ProcessMaker versions prior to 3.5.4 due to improper handling of uploaded plugin archives. An attacker with administrative privileges can upload a malicious .tar plugin file containing arbitrary PHP code. Upon installation, the plugin’s install() method is invoked, resulting in execution of attacker-supplied PHP code on the server with the privileges of the web server user. This vulnerability can be chained with CVE-2022-38577 — a privilege escalation flaw in the user profile page — to achieve full remote code execution from a low-privileged account.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-434 - Unrestricted Upload of File with Dangerous Type
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://raw.githubusercontent.com/rapid7/metasplo… | exploit |
| https://wiki.processmaker.net/3.0/Plugin_Development | product |
| https://www.fortiguard.com/encyclopedia/ips/45757 | third-party-advisory |
| https://www.exploit-db.com/exploits/44399 | exploit |
| https://process-maker-authenticated-plugin-upload-rce | third-party-advisory |
| https://vulncheck.com/advisories/process-maker-au… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ProcessMaker Inc. | ProcessMaker |
Affected:
0 , < 3.5.4
(semver)
|
Date Public
2018-04-04 00:00
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-34097",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-07-11T13:21:37.219420Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-07-11T13:21:51.637Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"/setup/pluginsImportFile",
"form[PLUGIN_FILENAME]"
],
"product": "ProcessMaker",
"vendor": "ProcessMaker Inc.",
"versions": [
{
"lessThan": "3.5.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:processmaker:processmaker:*:*:*:*:community:*:*:*",
"versionEndExcluding": "3.5.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "bcoles"
}
],
"datePublic": "2018-04-04T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn unrestricted file upload vulnerability exists in ProcessMaker versions prior to 3.5.4 due to improper handling of uploaded plugin archives. An attacker with administrative privileges can upload a malicious \u003ccode\u003e.tar\u003c/code\u003e plugin file containing arbitrary PHP code. Upon installation, the plugin\u2019s \u003ccode\u003einstall()\u003c/code\u003e method is invoked, resulting in execution of attacker-supplied PHP code on the server with the privileges of the web server user.\u0026nbsp;This vulnerability can be chained with CVE-2022-38577 \u2014 a privilege escalation flaw in the user profile page \u2014 to achieve full remote code execution from a low-privileged account.\u003c/p\u003e"
}
],
"value": "An unrestricted file upload vulnerability exists in ProcessMaker versions prior to 3.5.4 due to improper handling of uploaded plugin archives. An attacker with administrative privileges can upload a malicious .tar plugin file containing arbitrary PHP code. Upon installation, the plugin\u2019s install() method is invoked, resulting in execution of attacker-supplied PHP code on the server with the privileges of the web server user.\u00a0This vulnerability can be chained with CVE-2022-38577 \u2014 a privilege escalation flaw in the user profile page \u2014 to achieve full remote code execution from a low-privileged account."
}
],
"impacts": [
{
"capecId": "CAPEC-242",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-242 Code Injection"
}
]
},
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-434",
"description": "CWE-434 Unrestricted Upload of File with Dangerous Type",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-15T11:14:40.171Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/processmaker_plugin_upload.rb"
},
{
"tags": [
"product"
],
"url": "https://wiki.processmaker.net/3.0/Plugin_Development"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.fortiguard.com/encyclopedia/ips/45757"
},
{
"tags": [
"exploit"
],
"url": "https://www.exploit-db.com/exploits/44399"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://process-maker-authenticated-plugin-upload-rce"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://vulncheck.com/advisories/process-maker-authenticated-plugin-upload-rce"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "ProcessMaker \u003c 3.5.4 Authenticated Plugin Upload RCE",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2025-34097",
"datePublished": "2025-07-10T19:12:37.309Z",
"dateReserved": "2025-04-15T19:15:22.555Z",
"dateUpdated": "2026-05-15T11:14:40.171Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-34097 (GCVE-0-2025-34097)
Vulnerability from nvd – Published: 2025-07-10 19:12 – Updated: 2026-05-15 11:14
VLAI
Title
ProcessMaker < 3.5.4 Authenticated Plugin Upload RCE
Summary
An unrestricted file upload vulnerability exists in ProcessMaker versions prior to 3.5.4 due to improper handling of uploaded plugin archives. An attacker with administrative privileges can upload a malicious .tar plugin file containing arbitrary PHP code. Upon installation, the plugin’s install() method is invoked, resulting in execution of attacker-supplied PHP code on the server with the privileges of the web server user. This vulnerability can be chained with CVE-2022-38577 — a privilege escalation flaw in the user profile page — to achieve full remote code execution from a low-privileged account.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-434 - Unrestricted Upload of File with Dangerous Type
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://raw.githubusercontent.com/rapid7/metasplo… | exploit |
| https://wiki.processmaker.net/3.0/Plugin_Development | product |
| https://www.fortiguard.com/encyclopedia/ips/45757 | third-party-advisory |
| https://www.exploit-db.com/exploits/44399 | exploit |
| https://process-maker-authenticated-plugin-upload-rce | third-party-advisory |
| https://vulncheck.com/advisories/process-maker-au… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ProcessMaker Inc. | ProcessMaker |
Affected:
0 , < 3.5.4
(semver)
|
Date Public
2018-04-04 00:00
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-34097",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-07-11T13:21:37.219420Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-07-11T13:21:51.637Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"/setup/pluginsImportFile",
"form[PLUGIN_FILENAME]"
],
"product": "ProcessMaker",
"vendor": "ProcessMaker Inc.",
"versions": [
{
"lessThan": "3.5.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:processmaker:processmaker:*:*:*:*:community:*:*:*",
"versionEndExcluding": "3.5.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "bcoles"
}
],
"datePublic": "2018-04-04T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn unrestricted file upload vulnerability exists in ProcessMaker versions prior to 3.5.4 due to improper handling of uploaded plugin archives. An attacker with administrative privileges can upload a malicious \u003ccode\u003e.tar\u003c/code\u003e plugin file containing arbitrary PHP code. Upon installation, the plugin\u2019s \u003ccode\u003einstall()\u003c/code\u003e method is invoked, resulting in execution of attacker-supplied PHP code on the server with the privileges of the web server user.\u0026nbsp;This vulnerability can be chained with CVE-2022-38577 \u2014 a privilege escalation flaw in the user profile page \u2014 to achieve full remote code execution from a low-privileged account.\u003c/p\u003e"
}
],
"value": "An unrestricted file upload vulnerability exists in ProcessMaker versions prior to 3.5.4 due to improper handling of uploaded plugin archives. An attacker with administrative privileges can upload a malicious .tar plugin file containing arbitrary PHP code. Upon installation, the plugin\u2019s install() method is invoked, resulting in execution of attacker-supplied PHP code on the server with the privileges of the web server user.\u00a0This vulnerability can be chained with CVE-2022-38577 \u2014 a privilege escalation flaw in the user profile page \u2014 to achieve full remote code execution from a low-privileged account."
}
],
"impacts": [
{
"capecId": "CAPEC-242",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-242 Code Injection"
}
]
},
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-434",
"description": "CWE-434 Unrestricted Upload of File with Dangerous Type",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-15T11:14:40.171Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/processmaker_plugin_upload.rb"
},
{
"tags": [
"product"
],
"url": "https://wiki.processmaker.net/3.0/Plugin_Development"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.fortiguard.com/encyclopedia/ips/45757"
},
{
"tags": [
"exploit"
],
"url": "https://www.exploit-db.com/exploits/44399"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://process-maker-authenticated-plugin-upload-rce"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://vulncheck.com/advisories/process-maker-authenticated-plugin-upload-rce"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "ProcessMaker \u003c 3.5.4 Authenticated Plugin Upload RCE",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2025-34097",
"datePublished": "2025-07-10T19:12:37.309Z",
"dateReserved": "2025-04-15T19:15:22.555Z",
"dateUpdated": "2026-05-15T11:14:40.171Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}