CVE-2025-34300: Sawtooth Software Lighthouse Studio < 9.16.14 Pre-Authentication RCE

Severity: critical (CVSS 10.0 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 81.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-07-16 · updated 2026-06-17
Weakness: CWE-20

Description

A template injection vulnerability exists in Sawtooth Software’s Lighthouse Studio versions prior to 9.16.14 via the ciwweb.pl http://ciwweb.pl/ Perl web application. Exploitation allows an unauthenticated attacker can execute arbitrary commands.

Affected products

Sawtooth Software Lighthouse Studio: before 9.16.14 — fixed in 9.16.14

How to fix

Upgrade to a fixed version: Sawtooth Software Lighthouse Studio 9.16.14. Check the vendor advisory for mitigations.

References

https://sawtoothsoftware.com/resources/software-downloads/lighthouse-studio/version-history
https://slcyber.io/assetnote-security-research-center/rce-in-the-most-popular-survey-software-youve-never-heard-of/
https://www.vulncheck.com/advisories/sawtooth-software-lighthouse-studio-preauthentication-rce
https://slcyber.io/assetnote-security-research-center/rce-in-the-most-popular-survey-software-youve-never-heard-of/

Get alerted when CVE-2025-34300 or the next vulnerability affects your stack