CVE-2025-34300

CVE-2025-34300 is a template injection flaw (CWE-1336, with related improper input validation CWE-20) in the ciwweb.pl Perl web application used by Sawtooth Software's Lighthouse Studio survey platform. An unauthenticated remote attacker can submit crafted input that is processed as a template by ciwweb.pl, causing the server to evaluate and execute attacker-controlled commands. Successful exploitation yields full remote code execution on the hosting web server, with high impact on confidentiality, integrity, and availability reflected in the maximum CVSS 4.0 score of 10. Any organization running Lighthouse Studio versions prior to 9.16.14 with the ciwweb.pl survey application exposed via the web is affected. Exploitation has not yet been confirmed in the wild (no KEV listing, no public PoC), but the EPSS score of 78.1% (100th percentile) indicates a very high likelihood of exploitation within the next 30 days.

What to do: Upgrade Sawtooth Software Lighthouse Studio to version 9.16.14 or later. If upgrading is not immediately possible, restrict network access to the server hosting ciwweb.pl (e.g., allow only trusted clients or place it behind a VPN/WAF) and monitor web logs for suspicious command execution activity. Given the very high EPSS score, prioritize patching internet-facing survey hosting servers first.