PatchTheCEVCVE-2025-30050: CGM CLININET is vulnerable to Code Injection in the RunCGI.pm component, which dynamically imports the module
36
This month
CRITICAL 9.4
CVE-2025-30050 is a critical-severity flaw (CVSS 9.4) affecting affected software. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
CGM CLININET is vulnerable to Code Injection in the RunCGI.pm component, which dynamically imports the module specified as a query parameter and executes code from untrusted data provided by the user. An attacker from adjacent network can supply a crafted query parameter to have an attacker-controlled module imported which results in arbitrary code execution with root privileges. This issue was fixed in version 2026.MS3
Why this priority
- Critical severity
No fix is published yet: follow the downgrade or mitigation steps.
Risk facts
| CVSS score | 9.4 (Critical) |
| Attack vector | Adjacent network |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.2% (top 88%) |
| CISA exploited list | No |
| Weakness | CWE-94 |
| Published | 2026-10-23 |
| Last modified | 2026-10-23 |
Publisher (CNA): CERT.PL
Timeline
- Published CVE record published
- Updated Record last modified
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.