Code Injection Vulnerability in CGM CLININET
CVE-2025-30050

9.4CRITICAL

Key Information:

Vendor

Cgm

Status
Cgm Clininet
Vendor
CVE Published:
23 October 2026

What is CVE-2025-30050?

CGM CLININET is susceptible to a code injection flaw within the RunCGI.pm component, which allows for the dynamic importation of modules specified via a user-supplied query parameter. This vulnerability enables an attacker on an adjacent network to submit a specially crafted query that facilitates the execution of untrusted code, potentially leading to arbitrary code execution with root privileges. The issue was remediated in version 2026.MS3.

Affected Version(s)

CGM CLININET 0 < 2026.MS3

References

https://cert.pl/en/posts/2026/10/CVE-2025-30043/
third-party-advisory
https://www.cgm.com/pol_pl/products/szpital/cgm-clininet....
product

CVSS V4

Score:
9.4
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.