EUVD-2025-21034CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Lifecycle Timeline
4Description
An unrestricted file upload vulnerability exists in ProcessMaker versions prior to 3.5.4 due to improper handling of uploaded plugin archives. An attacker with administrative privileges can upload a malicious .tar plugin file containing arbitrary PHP code. Upon installation, the plugin’s install() method is invoked, resulting in execution of attacker-supplied PHP code on the server with the privileges of the web server user. This vulnerability can be chained with CVE-2022-38577 - a privilege escalation flaw in the user profile page - to achieve full remote code execution from a low-privileged account.
Analysis
ProcessMaker BPM platform versions prior to 3.5.4 contain an unrestricted file upload vulnerability in the plugin installation mechanism. An admin can upload a malicious .tar plugin containing arbitrary PHP code that executes during the plugin's install() method, achieving remote code execution on the workflow automation server.
Technical Context
ProcessMaker's plugin installation accepts .tar archives without validating contents. A malicious plugin with arbitrary PHP code in its install() method executes during installation. Admin authentication is required but ProcessMaker often uses default credentials in enterprise deployments.
Affected Products
['ProcessMaker < 3.5.4']
Remediation
Update to ProcessMaker 3.5.4 or later. Restrict plugin installation to verified packages. Change default admin credentials. Monitor the plugin directory for unauthorized files.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today