| Package | Affected versions | Patched versions |
|---|---|---|
| matomo | = 3.9.1 |
A full path disclosure vulnerability was discovered in Matomo v3.9.1 where a user can trigger a particular error to discover the full path of Matomo on the disk, because lastError.file is used in plugins/CorePluginsAdmin/templates/safemode.twig. NOTE: the vendor disputes the significance of this issue, stating "avoid reporting path disclosures, as we don't consider them as security vulnerabilities.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free