CVE-2025-34097 is a high-severity vulnerability in ProcessMaker prior to version 3.5.4 involving improper validation of uploaded plugin archives. An attacker with admin rights can upload a crafted .tar plugin file containing malicious PHP code. Upon installation, the plugin's install() method runs this code with the web server's privileges, enabling remote code execution. This flaw can be chained with CVE-2022-38577, a privilege escalation vulnerability, to escalate from low-privileged user to full remote code execution.

Successful exploitation allows execution of arbitrary PHP code on the server with web server user privileges, potentially leading to full system compromise if combined with other vulnerabilities. This can result in unauthorized control over the affected ProcessMaker instance and its underlying infrastructure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrative access to trusted users only and monitor for suspicious plugin uploads. Avoid installing untrusted plugins. Follow vendor communications for updates on patches or official mitigations.