CVE-2025-34095

Deeper analysis

An OS command injection vulnerability affects Mako Server versions 2.5 and 2.6 within the tutorial interface at the examples/save.lsp endpoint. Tracked as CWE-78 with a CVSS 4.0 score of 9.3, the flaw allows arbitrary Lua os.execute() commands to be supplied in a PUT request; the payload is written to disk and later executed when examples/manage.lsp is accessed via GET, impacting both Windows and Unix deployments.

Unauthenticated remote attackers can exploit the issue without user interaction or credentials. By chaining the PUT and GET requests, an adversary achieves arbitrary command execution on the underlying operating system, enabling full compromise of the host.

Public exploit artifacts are referenced in a Rapid7 Metasploit module, a VulnCheck advisory, and an Exploit-DB entry. The EPSS score is currently 0.6661 at its observed peak, reflecting substantial exploitation probability.