---
id: "CVE-2025-30045"
kind: "vulnerability"
aliases: ["CVE-2025-30045"]
title: "CGM CLININET: Perl expression handling lets an authenticated user run root code"
severity: "high"
cvss: 8.6
epss: 0.00199
exploited: false
status: "open"
category: "other"
products: [{"name": "CGM CLININET", "fixed": [], "affected": "<= 2026.MS3", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["cgm-clininet", "healthcare-it", "linux", "other", "perl", "rce", "windows"]
not_affected_if: ["auth-required", "unauthenticated-only-access"]
published_at: "2026-10-23T09:17:04+00:00"
first_seen_at: "2026-10-23T21:57:32+00:00"
updated_at: "2026-10-24T07:15:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30045", "first_seen_at": "2026-10-23T21:57:32+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:37:32+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2025-30045", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# CGM CLININET: Perl expression handling lets an authenticated user run root code

CGM CLININET's ConvExpr function evaluates Perl expressions while building RTF document content. A logged-in, high-privileged user can run arbitrary code as root on the server. CERT Polska confirms all versions through 2026.MS3 are affected and later ones may be too. No fixed release is published.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:CGM CLININET affected <= 2026.MS3 fixed ?

## How to check

Check the installed CLININET release. Anything 2026.MS3 or earlier is affected. The advisory gives no file or command for this, so ask CGM. Also review which accounts hold high privileges, since exploitation needs one.

## Fix

No fixed version is published. Unknown: ask CGM for a release after 2026.MS3. Until then, limit high-privilege accounts and keep the server off untrusted networks (the CVSS vector is adjacent-network).

## Timeline

- 2026-10-23T21:57:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2025-30045
- 2026-10-23T23:37:32+00:00 analyst — CERT Polska advisory (CNA) read: affects all versions through 2026.MS3, no fixed version published; sibling CVEs fixed in MS3 but this one is not. No exploit or PoC per VulDB; no social discussion searched.
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2025-30045

## Documents

- [advisory] CERT Polska: Vulnerabilities in CGM CLININET software https://cert.pl/en/posts/2026/10/CVE-2025-30043/
- [mentions] VulDB: CGM CLININET ConvExpr code injection https://vuldb.com/vuln/425619

## From the sources

CGM CLININET is vulnerable to Code Injection in the ConvExpr function, which processes Perl expressions into RTF document content. Due to improper control of the code evaluated from these expressions, an authenticated, high-privileged attacker can cause arbitrary code to be executed with root privileges. 


The vulnerability was confirmed to affect versions up to 2026.MS3 but later versions may also be vulnerable.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_