File size: 7,786 Bytes
bc63d7d | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 | {
"name": "matomo/matomo",
"type": "project",
"description": "Matomo is the leading Free/Libre open analytics platform",
"keywords": [
"piwik",
"matomo",
"web",
"analytics"
],
"homepage": "https://matomo.org",
"license": "GPL-3.0+",
"authors": [
{
"name": "The Matomo Team",
"email": "hello@matomo.org",
"homepage": "https://matomo.org/team/"
}
],
"support": {
"forum": "https://forum.matomo.org/",
"issues": "https://github.com/matomo-org/matomo/issues",
"wiki": "https://github.com/matomo-org/matomo/wiki",
"source": "https://github.com/matomo-org/matomo"
},
"config": {
"audit": {
"ignore": {
"PKSA-1tmc-rt7x-12w6": "CVE-2026-48806 (sandbox `__toString()` bypass via dynamic mapping keys): not exploitable - Matomo does not enable Twig's sandbox. Upgrade blocked while Matomo supports PHP 7.2.",
"PKSA-21g2-dzjv-sky5": "CVE-2026-46634 (`template_from_string()` escapes a SourcePolicy-driven sandbox): not exploitable - Matomo does not call `template_from_string`/`createTemplate` at runtime (only one TagManager test fixture) and does not implement `SourcePolicyInterface`. Upgrade blocked while Matomo supports PHP 7.2.",
"PKSA-3mcc-k66d-pydb": "CVE-2026-46638 (`{% sandbox %}{% include %}` skips `checkSecurity()` on cached templates): not exploitable - Matomo uses neither the `{% sandbox %}` tag nor `SandboxExtension`. Upgrade blocked while Matomo supports PHP 7.2.",
"PKSA-8zx5-v2nz-58pb": "CVE-2026-49981 (sandbox filter, tag and function allow-list bypass when sandbox state changes between renders for a cached `Template`): not exploitable - Matomo does not enable Twig's sandbox or toggle sandbox state. Upgrade blocked while Matomo supports PHP 7.2.",
"PKSA-dpx1-78wg-1kqs": "CVE-2026-47732 (multiple sandbox `__toString()` bypasses via unguarded string coercion points): not exploitable - Matomo does not enable Twig's sandbox. Upgrade blocked while Matomo supports PHP 7.2.",
"PKSA-fbvq-z33h-r2np": "CVE-2026-48808 (sandbox property allowlist bypass via `column` filter under `SourcePolicyInterface`): not exploitable - Matomo does not register `SandboxExtension` or implement `SourcePolicyInterface`. Upgrade blocked while Matomo supports PHP 7.2.",
"PKSA-g9zw-qxh8-pq8w": "CVE-2026-48805 (sandbox state regression in deprecated wrappers in `vendor/twig/twig/src/Resources/core.php`): not exploitable - Matomo does not enable Twig's sandbox. Upgrade blocked while Matomo supports PHP 7.2.",
"PKSA-gw7n-z4yx-7xjt": "CVE-2026-24425 (possible sandbox bypass when using a source policy): not exploitable - Matomo does not implement `SourcePolicyInterface` or enable Twig's sandbox. Upgrade blocked while Matomo supports PHP 7.2.",
"PKSA-h8hf-ytnd-5t9q": "CVE-2026-46633 (PHP code injection via `{% use %}` template name): not exploitable - no Matomo template uses the `{% use %}` tag and no PHP code emits `{% use` content at runtime. Upgrade blocked while Matomo supports PHP 7.2.",
"PKSA-hgmw-wn4d-hpcy": "CVE-2026-46639 (sandbox property and method bypass via object-destructuring assignment): not exploitable - Matomo does not enable Twig's sandbox; vulnerable range (Twig >=3.24.0,<3.26.0) does not even cover Matomo's pinned 3.11.3. Upgrade blocked while Matomo supports PHP 7.2.",
"PKSA-kvv6-36cr-fkzb": "CVE-2026-46627 (sandbox does not protect against resource exhaustion): not exploitable - Matomo does not enable Twig's sandbox; templates are author-trusted. Upgrade blocked while Matomo supports PHP 7.2.",
"PKSA-n14z-jjjg-g8vd": "CVE-2026-46635 (sandbox property allowlist bypass via `column` filter / `array_column` on objects): not exploitable - Matomo does not enable Twig's sandbox. Upgrade blocked while Matomo supports PHP 7.2.",
"PKSA-sjvz-tbbr-vwth": "CVE-2026-46628 (`spaceless` filter implicitly marks output as safe): not exploitable - variables inside Matomo's six `{% apply spaceless %}` blocks (CoreHome, CustomAlerts, Marketplace, Ecommerce, SegmentEditor) go through normal `{{ }}` auto-escaping; no `|spaceless` filter form is used, and the only `|raw` uses inside cover plugin-supplied metadata (e.g. `html_label_prefix`, `menu._html`), not request input. Upgrade blocked while Matomo supports PHP 7.2.",
"PKSA-wwb1-81rc-pd65": "CVE-2026-47730 (XSS in profiler `HtmlDumper` via unescaped template and profile names): not exploitable - Matomo does not register `ProfilerExtension` or use `HtmlDumper`. Upgrade blocked while Matomo supports PHP 7.2.",
"PKSA-xx6c-6d96-db2w": "CVE-2026-48807 (sandbox `__toString()` bypass via `Traversable` in `join`/`replace` filters and `in`/`not in` operators): not exploitable - Matomo does not enable Twig's sandbox. Upgrade blocked while Matomo supports PHP 7.2.",
"PKSA-yd6k-t2gh-1m43": "CVE-2026-46636 (cached-Template sandbox allow-list bypass when sandbox state changes between renders): not exploitable - Matomo does not enable Twig's sandbox or toggle sandbox state. Upgrade blocked while Matomo supports PHP 7.2."
}
},
"platform": {
"php": "7.2.9"
},
"prepend-autoloader": false,
"sort-packages": true,
"allow-plugins": {
"dealerdirect/phpcodesniffer-composer-installer": true
}
},
"repositories": [
{
"type": "vcs",
"url": "https://github.com/matomo-org/matomo-coding-standards.git"
}
],
"require": {
"php": ">=7.2.5",
"composer/ca-bundle": "^1.2",
"composer/semver": "^3.0",
"davaxi/sparkline": "~2.0",
"geoip2/geoip2": "^2.8",
"lox/xhprof": "dev-master",
"matomo/cache": "~3.0",
"matomo/decompress": "~2.0",
"matomo/device-detector": "~6.0",
"matomo/ini": "~3.0",
"matomo/matomo-php-tracker": "~3.3.0",
"matomo/network": "~2.0",
"matomo/referrer-spam-list": "dev-master",
"matomo/searchengine-and-social-list": "dev-master",
"monolog/monolog": "~1.11",
"mustangostang/spyc": "^0.6.0",
"pear/pear_exception": "~1.0.0",
"php-di/php-di": "^6.0.0",
"phpmailer/phpmailer": "^7.0",
"psr/log": "~1.0",
"symfony/console": "~5.4.0",
"symfony/event-dispatcher": "~5.4.0",
"symfony/monolog-bridge": "~5.4.0",
"symfony/polyfill-iconv": "^1.20",
"symfony/polyfill-mbstring": "^1.20",
"symfony/process": "~5.4.0",
"szymach/c-pchart": "~3.0.13",
"tecnickcom/tcpdf": "~6.0",
"tedivm/jshrink": "^1.7.0",
"twig/twig": ">=3.11.3 <3.12",
"wikimedia/less.php": "^3.0"
},
"require-dev": {
"matomo-org/matomo-coding-standards": "dev-master",
"phpstan/phpdoc-parser": "~1.24.0",
"phpstan/phpstan": "~1.12",
"phpunit/phpunit": "~8.5",
"symfony/var-dumper": "~5.4.0",
"symfony/yaml": "~5.4.0"
},
"autoload": {
"psr-4": {
"Piwik\\Plugins\\": "plugins/",
"Piwik\\": "core/"
},
"psr-0": {
"Zend_": "libs/",
"HTML_": "libs/",
"PEAR_": "libs/",
"Archive_": "libs/"
},
"files": [
"LegacyAutoloader.php"
]
},
"autoload-dev": {
"psr-4": {
"Piwik\\Tests\\": "tests/PHPUnit/"
}
},
"scripts": {
"phpstan": "phpstan analyse -c phpstan.neon"
}
}
|