| { |
| "name": "matomo/matomo", |
| "type": "project", |
| "description": "Matomo is the leading Free/Libre open analytics platform", |
| "keywords": [ |
| "piwik", |
| "matomo", |
| "web", |
| "analytics" |
| ], |
| "homepage": "https://matomo.org", |
| "license": "GPL-3.0+", |
| "authors": [ |
| { |
| "name": "The Matomo Team", |
| "email": "hello@matomo.org", |
| "homepage": "https://matomo.org/team/" |
| } |
| ], |
| "support": { |
| "forum": "https://forum.matomo.org/", |
| "issues": "https://github.com/matomo-org/matomo/issues", |
| "wiki": "https://github.com/matomo-org/matomo/wiki", |
| "source": "https://github.com/matomo-org/matomo" |
| }, |
| "config": { |
| "audit": { |
| "ignore": { |
| "PKSA-1tmc-rt7x-12w6": "CVE-2026-48806 (sandbox `__toString()` bypass via dynamic mapping keys): not exploitable - Matomo does not enable Twig's sandbox. Upgrade blocked while Matomo supports PHP 7.2.", |
| "PKSA-21g2-dzjv-sky5": "CVE-2026-46634 (`template_from_string()` escapes a SourcePolicy-driven sandbox): not exploitable - Matomo does not call `template_from_string`/`createTemplate` at runtime (only one TagManager test fixture) and does not implement `SourcePolicyInterface`. Upgrade blocked while Matomo supports PHP 7.2.", |
| "PKSA-3mcc-k66d-pydb": "CVE-2026-46638 (`{% sandbox %}{% include %}` skips `checkSecurity()` on cached templates): not exploitable - Matomo uses neither the `{% sandbox %}` tag nor `SandboxExtension`. Upgrade blocked while Matomo supports PHP 7.2.", |
| "PKSA-8zx5-v2nz-58pb": "CVE-2026-49981 (sandbox filter, tag and function allow-list bypass when sandbox state changes between renders for a cached `Template`): not exploitable - Matomo does not enable Twig's sandbox or toggle sandbox state. Upgrade blocked while Matomo supports PHP 7.2.", |
| "PKSA-dpx1-78wg-1kqs": "CVE-2026-47732 (multiple sandbox `__toString()` bypasses via unguarded string coercion points): not exploitable - Matomo does not enable Twig's sandbox. Upgrade blocked while Matomo supports PHP 7.2.", |
| "PKSA-fbvq-z33h-r2np": "CVE-2026-48808 (sandbox property allowlist bypass via `column` filter under `SourcePolicyInterface`): not exploitable - Matomo does not register `SandboxExtension` or implement `SourcePolicyInterface`. Upgrade blocked while Matomo supports PHP 7.2.", |
| "PKSA-g9zw-qxh8-pq8w": "CVE-2026-48805 (sandbox state regression in deprecated wrappers in `vendor/twig/twig/src/Resources/core.php`): not exploitable - Matomo does not enable Twig's sandbox. Upgrade blocked while Matomo supports PHP 7.2.", |
| "PKSA-gw7n-z4yx-7xjt": "CVE-2026-24425 (possible sandbox bypass when using a source policy): not exploitable - Matomo does not implement `SourcePolicyInterface` or enable Twig's sandbox. Upgrade blocked while Matomo supports PHP 7.2.", |
| "PKSA-h8hf-ytnd-5t9q": "CVE-2026-46633 (PHP code injection via `{% use %}` template name): not exploitable - no Matomo template uses the `{% use %}` tag and no PHP code emits `{% use` content at runtime. Upgrade blocked while Matomo supports PHP 7.2.", |
| "PKSA-hgmw-wn4d-hpcy": "CVE-2026-46639 (sandbox property and method bypass via object-destructuring assignment): not exploitable - Matomo does not enable Twig's sandbox; vulnerable range (Twig >=3.24.0,<3.26.0) does not even cover Matomo's pinned 3.11.3. Upgrade blocked while Matomo supports PHP 7.2.", |
| "PKSA-kvv6-36cr-fkzb": "CVE-2026-46627 (sandbox does not protect against resource exhaustion): not exploitable - Matomo does not enable Twig's sandbox; templates are author-trusted. Upgrade blocked while Matomo supports PHP 7.2.", |
| "PKSA-n14z-jjjg-g8vd": "CVE-2026-46635 (sandbox property allowlist bypass via `column` filter / `array_column` on objects): not exploitable - Matomo does not enable Twig's sandbox. Upgrade blocked while Matomo supports PHP 7.2.", |
| "PKSA-sjvz-tbbr-vwth": "CVE-2026-46628 (`spaceless` filter implicitly marks output as safe): not exploitable - variables inside Matomo's six `{% apply spaceless %}` blocks (CoreHome, CustomAlerts, Marketplace, Ecommerce, SegmentEditor) go through normal `{{ }}` auto-escaping; no `|spaceless` filter form is used, and the only `|raw` uses inside cover plugin-supplied metadata (e.g. `html_label_prefix`, `menu._html`), not request input. Upgrade blocked while Matomo supports PHP 7.2.", |
| "PKSA-wwb1-81rc-pd65": "CVE-2026-47730 (XSS in profiler `HtmlDumper` via unescaped template and profile names): not exploitable - Matomo does not register `ProfilerExtension` or use `HtmlDumper`. Upgrade blocked while Matomo supports PHP 7.2.", |
| "PKSA-xx6c-6d96-db2w": "CVE-2026-48807 (sandbox `__toString()` bypass via `Traversable` in `join`/`replace` filters and `in`/`not in` operators): not exploitable - Matomo does not enable Twig's sandbox. Upgrade blocked while Matomo supports PHP 7.2.", |
| "PKSA-yd6k-t2gh-1m43": "CVE-2026-46636 (cached-Template sandbox allow-list bypass when sandbox state changes between renders): not exploitable - Matomo does not enable Twig's sandbox or toggle sandbox state. Upgrade blocked while Matomo supports PHP 7.2." |
| } |
| }, |
| "platform": { |
| "php": "7.2.9" |
| }, |
| "prepend-autoloader": false, |
| "sort-packages": true, |
| "allow-plugins": { |
| "dealerdirect/phpcodesniffer-composer-installer": true |
| } |
| }, |
| "repositories": [ |
| { |
| "type": "vcs", |
| "url": "https://github.com/matomo-org/matomo-coding-standards.git" |
| } |
| ], |
| "require": { |
| "php": ">=7.2.5", |
| "composer/ca-bundle": "^1.2", |
| "composer/semver": "^3.0", |
| "davaxi/sparkline": "~2.0", |
| "geoip2/geoip2": "^2.8", |
| "lox/xhprof": "dev-master", |
| "matomo/cache": "~3.0", |
| "matomo/decompress": "~2.0", |
| "matomo/device-detector": "~6.0", |
| "matomo/ini": "~3.0", |
| "matomo/matomo-php-tracker": "~3.3.0", |
| "matomo/network": "~2.0", |
| "matomo/referrer-spam-list": "dev-master", |
| "matomo/searchengine-and-social-list": "dev-master", |
| "monolog/monolog": "~1.11", |
| "mustangostang/spyc": "^0.6.0", |
| "pear/pear_exception": "~1.0.0", |
| "php-di/php-di": "^6.0.0", |
| "phpmailer/phpmailer": "^7.0", |
| "psr/log": "~1.0", |
| "symfony/console": "~5.4.0", |
| "symfony/event-dispatcher": "~5.4.0", |
| "symfony/monolog-bridge": "~5.4.0", |
| "symfony/polyfill-iconv": "^1.20", |
| "symfony/polyfill-mbstring": "^1.20", |
| "symfony/process": "~5.4.0", |
| "szymach/c-pchart": "~3.0.13", |
| "tecnickcom/tcpdf": "~6.0", |
| "tedivm/jshrink": "^1.7.0", |
| "twig/twig": ">=3.11.3 <3.12", |
| "wikimedia/less.php": "^3.0" |
| }, |
| "require-dev": { |
| "matomo-org/matomo-coding-standards": "dev-master", |
| "phpstan/phpdoc-parser": "~1.24.0", |
| "phpstan/phpstan": "~1.12", |
| "phpunit/phpunit": "~8.5", |
| "symfony/var-dumper": "~5.4.0", |
| "symfony/yaml": "~5.4.0" |
| }, |
| "autoload": { |
| "psr-4": { |
| "Piwik\\Plugins\\": "plugins/", |
| "Piwik\\": "core/" |
| }, |
| "psr-0": { |
| "Zend_": "libs/", |
| "HTML_": "libs/", |
| "PEAR_": "libs/", |
| "Archive_": "libs/" |
| }, |
| "files": [ |
| "LegacyAutoloader.php" |
| ] |
| }, |
| "autoload-dev": { |
| "psr-4": { |
| "Piwik\\Tests\\": "tests/PHPUnit/" |
| } |
| }, |
| "scripts": { |
| "phpstan": "phpstan analyse -c phpstan.neon" |
| } |
| } |
|
|
