CVE-2025-34300
CriticalPublished
Sawtooth Software Lighthouse Studio < 9.16.14 Pre-Authentication RCE
- Published
- Jul 16, 2025
- Updated
- May 26, 2026
- Assigning CNA
- VulnCheck
- Evidence observed
- Aug 8, 2026
Primary CVSS
10.0/ 10Critical
nvd · CVSS 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X79.2%
High · next 30 days
- Percentile
- 99.6%
- Model date
- Sep 21, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
Summary
A template injection vulnerability exists in Sawtooth Software’s Lighthouse Studio versions prior to 9.16.14 via the ciwweb.pl http://ciwweb.pl/ Perl web application. Exploitation allows an unauthenticated attacker can execute arbitrary commands.
Sources
1Sawtooth Lighthouse Studio存在模板注入漏洞CVE-2025-34300
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.