A critical remote code execution vulnerability (CVE-2025-34300) has been discovered in Lighthouse Studio, a survey software platform developed by Sawtooth Software. This vulnerability affects the Perl CGI scripts that power web-based surveys, potentially exposing thousands of hosting servers to complete compromise. The flaw resides in the server-side components, where a templating engine processes user input without proper sanitization. Security researchers found that the software’s templating system evaluates content between [% %] markers as executable Perl code, creating a direct pathway for remote code execution. This issue amplifies the potential attack surface and complicates remediation efforts due to the proliferation of vulnerable script instances across web infrastructures.