CyberSecBulletin

ProcessMaker vulnerabilities

We track 2 vulnerabilities in ProcessMaker products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on July 10, 2025.

2vulnerabilities
0critical
2high
0exploited
8.7average CVSS score

Latest ProcessMaker vulnerabilities

  • 8.6 High severity

    ProcessMaker: Unrestricted Upload of File with Dangerous Type

    CVE-2025-34097ProcessMakerEPSS 1.72%

    An unrestricted file upload vulnerability exists in ProcessMaker versions prior to 3.5.4 due to improper handling of uploaded plugin archives. An attacker with administrative privileges can upload a malicious .tar plugin file containing arbitrary PHP code. Upo

  • 8.8 High severity

    Processmaker: Improper Preservation of Permissions

    CVE-2022-38577ProcessMakerEPSS 2.31%

    ProcessMaker before v3.5.4 was discovered to contain insecure permissions in the user profile page. This vulnerability allows attackers to escalate normal users to Administrators.