This vulnerability (CVE-2025-34095) affects Mako Server versions 2.5 and 2.6. It arises from improper neutralization of special elements in OS commands (CWE-78) within the tutorial interface. An attacker can exploit the examples/save.lsp endpoint by sending a malicious PUT request embedding Lua os.execute() code, which is saved on disk. When a subsequent GET request is made to examples/manage.lsp, the saved code is executed on the underlying OS, enabling remote command execution without authentication. The vulnerability impacts both Windows and Unix-based deployments and has a CVSS 4.0 base score of 9.3, indicating critical severity.

Successful exploitation allows unauthenticated remote attackers to execute arbitrary operating system commands on affected Mako Server instances. This can lead to full system compromise, data theft, service disruption, or further network penetration. Both Windows and Unix-based systems running vulnerable versions are affected. No known exploits in the wild have been reported yet.

No official patch or fix is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, it is recommended to disable or restrict access to the tutorial interface endpoints (examples/save.lsp and examples/manage.lsp) to trusted users only or block them entirely. Monitoring for unusual PUT or GET requests to these endpoints may help detect exploitation attempts.