This vulnerability (CVE-2025-34095) affects Mako Server versions 2.5 and 2.6 by improperly neutralizing special elements in OS commands within the tutorial interface. Specifically, the examples/save.lsp endpoint accepts unauthenticated PUT requests that include arbitrary Lua os.execute() code. This code is saved to disk and subsequently triggered by a GET request to examples/manage.lsp, enabling remote attackers to execute arbitrary commands on the underlying operating system. The issue impacts both Windows and Unix-based deployments. The CVSS 4.0 score is 9.3, reflecting a critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows unauthenticated remote attackers to execute arbitrary OS commands on the server hosting Mako Server, potentially leading to full system compromise. This affects both Windows and Unix-based systems running vulnerable versions 2.5 and 2.6. The vulnerability can be triggered remotely without authentication or user interaction, posing a severe risk to affected deployments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or fix links are provided in the available data. Until a patch is available, it is recommended to disable or restrict access to the tutorial interface endpoints (examples/save.lsp and examples/manage.lsp) to trusted users only or block them entirely if not needed. Monitor vendor channels for updates and apply official fixes once released.