{"id":"CVE-2025-30050","kind":"vulnerability","aliases":["CVE-2025-30050"],"related":[],"title":"CGM CLININET: crafted query parameter lets attacker run code as root","description":"CGM CLININET is vulnerable to Code Injection in the RunCGI.pm component, which dynamically imports the module specified as a query parameter and executes code from untrusted data provided by the user. An attacker from adjacent network can supply a crafted query parameter to have an attacker-controlled module imported which results in arbitrary code execution with root privileges.\n\n\nThis issue was fixed in version 2026.MS3","summary":"CGM CLININET's RunCGI.pm dynamically imports a module named in a query parameter, so an attacker can load a module they control. The result is arbitrary code execution with root privileges.","severity":"critical","cvss":9.4,"epss":0.00217,"exploited":false,"exploited_at":null,"products":[{"name":"CGM CLININET","fixed":["2026.MS3"],"affected":"< 2026.MS3","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["adjacent-network","cgm-clinet","cgm-clininet","healthcare","other","perl","rce","root","self-hosted","vendor"],"not_affected_if":["already-on-2026.ms3","no-adjacent-network-access"],"how_to_check":"Check the installed CGM CLININET version against the affected range below 2026.MS3.","fix":"Upgrade CGM CLININET to 2026.MS3 or later. Workaround: unknown","status":"open","published_at":"2026-10-23T09:17:04+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-23T22:31:31+00:00","updated_at":"2026-10-24T07:15:51+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-10-23T22:31:31Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade CGM CLININET to 2026.MS3 or later. Workaround: unknown","reach":"network","title":"CGM CLININET: crafted query parameter lets attacker run code as root","impact":"high","summary":"CGM CLININET's RunCGI.pm dynamically imports a module named in a query parameter, so an attacker can load a module they control. The result is arbitrary code execution with root privileges.","category":"vendor","who_cares":["cgm-clininet","healthcare","self-hosted","perl"],"confidence":0.7,"needs_auth":"unknown","worst_case":"Attacker runs code as root on the CLININET server","analyst_note":"Confirm the CLININET version check method and whether the query parameter path needs authentication, using the vendor advisory or NVD entry linked in the sources.","how_to_check":"Check the installed CGM CLININET version against the affected range below 2026.MS3.","needs_analyst":true,"not_affected_if":["already-on-2026.MS3","no-adjacent-network-access"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.0005,"input_tokens":3023,"output_tokens":395,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm the affected version range and vendor advisory for CGM CLININET; the NVD entry gives only the fixed version 2026.MS3, and the sources do not say how to check exposure.","search":"'-2025':13A,16A '-30050':14A,17A '2026':134C 'adjac':21B,103C 'adjacent-network':20B 'arbitrari':63B,122C 'attack':7A,53B,101C,115C 'attacker-control':114C 'cgm':1A,18A,24B,27B,38B,69C 'cgm-clinet':23B 'cgm-clininet':26B 'clinet':25B 'clininet':2A,19A,28B,39B,70C 'code':9A,64B,74C,92C,123C 'compon':79C 'control':59B,116C 'craft':3A,108C 'cve':12A,15A 'data':95C 'dynam':42B,81C 'execut':65B,91C,124C 'fix':131C 'healthcar':29B 'host':36B 'import':43B,82C,118C 'inject':75C 'issu':129C 'let':6A 'load':55B 'modul':45B,57B,84C,117C 'ms3':135C 'name':46B 'network':22B,104C 'paramet':5A,50B,89C,110C 'perl':31B 'privileg':68B,127C 'provid':96C 'queri':4A,49B,88C,109C 'rce':32B 'result':61B,120C 'root':11A,33B,67B,126C 'run':8A 'runcgi.pm':41B,78C 'self':35B 'self-host':34B 'specifi':85C 'suppli':106C 'untrust':94C 'user':99C 'vendor':37B 'version':133C 'vulner':72C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T09:17:04+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cvd@cert.pl","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2025-30050","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-30050","severity":null,"published_at":"2026-10-23T09:17:04+00:00","modified_at":"2026-10-23T16:28:32+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"analyst","external_id":"CVE-2025-30050:178","url":null,"severity":null,"published_at":"2026-10-23T22:12:26+00:00","modified_at":"2026-10-23T22:12:26+00:00","first_seen_at":"2026-10-23T22:12:26+00:00","fetched_at":"2026-10-23T22:12:26+00:00","note":"CERT Polska advisory (primary, CNA) confirms all versions before 2026.MS3 affected, fixed in 2026.MS3; no CGM advisory or PoC found, no exploitation reported; no social discussion checked (disclosed hours ago). Sibling CVEs in same advisory (30045/46/52/53/54, 58403) are NOT fixed in 2026.MS3."},{"source":"epss","external_id":"CVE-2025-30050","url":"https://api.first.org/data/v1/epss?cve=CVE-2025-30050","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[{"id":1323,"url":"https://cert.pl/en/posts/2026/10/CVE-2025-30043/","title":"CERT Polska: Vulnerabilities in CGM CLININET software","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}