Live › vulnerability › CVE-2025-30045
Go to dashboardCGM CLININET's ConvExpr function evaluates Perl expressions while building RTF document content. A logged-in, high-privileged user can run arbitrary code as root on the server. CERT Polska confirms all versions through 2026.MS3 are affected and later ones may be too. No fixed release is published.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| CGM CLININET | vendor | <= 2026.MS3 | – |
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
CGM CLININET is vulnerable to Code Injection in the ConvExpr function, which processes Perl expressions into RTF document content. Due to improper control of the code evaluated from these expressions, an authenticated, high-privileged attacker can cause arbitrary code to be executed with root privileges.
The vulnerability was confirmed to affect versions up to 2026.MS3 but later versions may also be vulnerable.
This page as .md · .json · in your agent: get_signal("CVE-2025-30045")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.