CVE-2025-34300: Sawtooth Software Lighthouse Studio

Critical severity, CVSS 10.0. EPSS: 80% chance of exploitation in the next 30 days.

A template injection vulnerability exists in Sawtooth Software’s Lighthouse Studio versions prior to 9.16.14 via the  ciwweb.pl http://ciwweb.pl/  Perl web application. Exploitation allows an unauthenticated attacker can execute arbitrary commands.

Affected products

• Sawtooth Software Lighthouse Studio: before 9.16.14 (fixed in 9.16.14)

Published 2025-07-16. Last modified 2026-06-17.