CVE-2025-34097 is a high-severity vulnerability in ProcessMaker prior to version 3.5.4 involving improper validation of uploaded plugin archives. An attacker with administrative access can upload a crafted .tar plugin file containing malicious PHP code. Upon installation, the plugin's install() method executes this code with web server privileges, enabling remote code execution. This vulnerability can be chained with CVE-2022-38577, a privilege escalation issue, to allow attackers starting from low-privileged accounts to fully compromise the system.

Successful exploitation results in execution of arbitrary PHP code on the server with web server user privileges, potentially leading to full system compromise when combined with a known privilege escalation vulnerability. This can allow attackers to control the affected ProcessMaker instance and access sensitive data or disrupt operations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrative access to trusted users only and monitor for suspicious plugin uploads. Avoid installing untrusted plugins. Follow vendor communications closely for updates and apply patches promptly once released.