CVE-2025-34095

Mako Server 2.5-2.6 - Command Injection

Title source: llm

Description

An OS command injection vulnerability exists in Mako Server versions 2.5 and 2.6, specifically within the tutorial interface provided by the examples/save.lsp endpoint. An unauthenticated attacker can send a crafted PUT request containing arbitrary Lua os.execute() code, which is then persisted on disk and triggered via a subsequent GET request to examples/manage.lsp. This allows remote command execution on the underlying operating system, impacting both Windows and Unix-based deployments.

Exploits (2)

exploitdb WORKING POC VERIFIED

by Metasploit · rubyremotewindows

https://www.exploit-db.com/exploits/43132

View Code ZIP pw:eip

metasploit WORKING POC EXCELLENT

by John Page (hyp3rlinx) - Beyond Security SecuriTeam Secure Disclosure · rubypoc

https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/makoserver_cmd_exec.rb

View Code ZIP pw:eip

References (3)

[Various Sources] https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/makoserver_cmd_exec.rb

[Various Sources] https://vulncheck/advisories/mako-server-rce

[Exploit, Third Party Advisory] https://www.exploit-db.com/exploits/43132

Scores

EPSS 0.4537

EPSS Percentile 97.5%

Classification

CWE

CWE-78

Status draft

Timeline

Published Jul 10, 2025

Tracked Since Feb 18, 2026