This vulnerability (CVE-2025-34300) affects Sawtooth Software's Lighthouse Studio prior to version 9.16.14 and involves a template injection flaw in the ciwweb.pl Perl web application. Due to improper input validation (CWE-20) and template injection (CWE-1336), an unauthenticated attacker can execute arbitrary commands remotely. The vulnerability has a CVSS 4.0 score of 10.0, reflecting critical risk with no required privileges or user interaction and full impact on confidentiality, integrity, and availability. The vulnerability is publicly disclosed but no patch or official remediation details are provided in the available information. The product is not cloud-hosted, so remediation depends on vendor patching or user updates.

Successful exploitation allows unauthenticated remote attackers to execute arbitrary commands on the affected system, leading to full compromise of confidentiality, integrity, and availability of the system running Lighthouse Studio. This can result in complete system takeover, data theft, or disruption of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users should monitor Sawtooth Software's advisories for updates. Until a fix is available, restrict network access to the ciwweb.pl application and consider disabling or isolating the vulnerable component if possible.