Servers and applications
CVE-2011-0401 Piwik before 1.1 does not properly limit the number of files stored under tmp/sessions/, which might allow remote attackers to cause a denial of service (inode consumption) by establishing many sessions.
Severity Medium 5.0
Published 10 Jan 2011
Last changed 16 Jun 2026
Added to UpHeron 21 Oct 2026 Exploit chance 1.7% in the next 30 daysHigher than 76% of CVEs. EPSS by FIRST , 12 Nov 2026
Attack Over the network · No login needed
Attacker can Slow it down
CVSS vector AV:N/AC:L/Au:N/C:N/I:N/A:P
Sources NVD Affected software Software Affected versions MatomoServers and applications · cpe:a:matomo:matomo Version 0.9.9 Version 0.9 Version 0.8 Version 0.7 All 67 release lines Every version up to 1.0 Version 0.1 Version 0.1.1 Version 0.1.2 Version 0.1.3 Version 0.1.4 Version 0.1.5 Version 0.1.6 Version 0.1.7 Version 0.1.8 Version 0.1.9 Version 0.1.10 Version 0.2.1 Version 0.2.2 Version 0.2.3 Version 0.2.4 Version 0.2.5 Version 0.2.6 Version 0.2.7 Version 0.2.8 Version 0.2.9 Version 0.2.10 Version 0.2.11 Version 0.2.12 Version 0.2.13 Version 0.2.14 Version 0.2.16 Version 0.2.17 Version 0.2.18 Version 0.2.19 Version 0.2.20 Version 0.2.22 Version 0.2.23 Version 0.2.24 Version 0.2.25 Version 0.2.26 Version 0.2.27 Version 0.2.28 Version 0.2.29 Version 0.2.30 Version 0.2.31 Version 0.2.32 Version 0.2.33 Version 0.2.34 Version 0.4-rc1 Version 0.4-rc2 Version 0.4-rc3 Version 0.4.1-rc1 Version 0.4.4 Version 0.4.5 Version 0.5 Version 0.5.1 Version 0.5.2 Version 0.5.3 Version 0.5.4 Version 0.5.5 Version 0.6 Version 0.6.1 Version 0.6.2 Version 0.6.3-rc1 Version 0.6.3-rc2 Version 0.6.3 Version 0.6.4 Version 0.7 Version 0.8 Version 0.9 Version 0.9.9
References NVD https://nvd.nist.gov/vuln/detail/CVE-2011-0401 CVE.org https://www.cve.org/CVERecord?id=CVE-2011-0401