CVE-2025-34300CWE-1336CWE-20

Sawtooth Software Lighthouse Studio < 9.16.14 Pre-Authentication RCE

Critical · published July 16, 2025

Patch now

High probability of exploitation

CVSS calls it critical at 10.0. It sits in the 99.6th percentile for exploit probability.

CVSS v4.0
10.0
EPSS
81%
Percentile
99.6
In the wild
Unconfirmed
What it is

A template injection vulnerability exists in Sawtooth Software’s Lighthouse Studio versions prior to 9.16.14 via the  ciwweb.pl http://ciwweb.pl/  Perl web application. Exploitation allows an unauthenticated attacker can execute arbitrary commands.

The record
Technical detail
CVSS v4.0
10.0 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
EPSS
0.81264 · 99.6th percentile
Weaknesses
CWE-1336 · Improper Neutralization of Special Elements Used in a Template Engine; CWE-20 · Improper Input Validation
Published
2025-07-16T12:57Z
EPSS history
Timeline
  • 07 SEP 03:29Z
    EPSS moved 51% → 78%
    epss
  • 06 SEP 03:27Z
    EPSS moved 51% → 78%
    epss
  • 16 JUL 12:57Z
    Sawtooth Software Lighthouse Studio < 9.16.14 Pre-Authentication RCE
    cvelistv5