---
id: "CVE-2025-30054"
kind: "vulnerability"
aliases: ["CVE-2025-30054"]
title: "CGM CLININET: uhcapache user can modify root-run HL7 scripts, gaining root"
severity: "critical"
cvss: 9.3
epss: 0.001
exploited: false
status: "open"
category: "other"
products: [{"name": "CGM CLININET", "fixed": [], "affected": "<= 2026.MS3", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["cgm-clininet", "healthcare", "linux", "other", "privilege-escalation", "self-hosted", "windows"]
not_affected_if: ["managed-hosting"]
published_at: "2026-10-23T09:17:05+00:00"
first_seen_at: "2026-10-23T21:57:32+00:00"
updated_at: "2026-10-24T07:15:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30054", "first_seen_at": "2026-10-23T21:57:32+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:12:31+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:37:34+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2025-30054", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# CGM CLININET: uhcapache user can modify root-run HL7 scripts, gaining root

CGM CLININET's HL7 message service runs as root but its scripts and config files are writable by the uhcapache user. An attacker who holds uhcapache rights can edit those files and run arbitrary code as root.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:CGM CLININET affected <= 2026.MS3 fixed ?

## Fix

No fixed version confirmed. CVE record and CERT Polska say all versions through 2026.MS3 are affected. One aggregator (notcve.org) claims a fix in 2026.MS4, but the CVE record does not say that, so ask CGM to confirm before relying on it. Until then, remove uhcapache write access to the HL7 service's scripts and config, limit who can get uhcapache access, and keep HL7 and admin ports off untrusted networks.

## Timeline

- 2026-10-23T21:57:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2025-30054
- 2026-10-23T22:12:31+00:00 analyst — Read CERT Polska advisory (primary, coordinated disclosure; no CGM advisory found). Affects all versions through 2026.MS3, no fixed version exists; later may be affected. CVSS 4.0 9.3 is local/PR:L, so critical rating rests on needing uhcapache access. No exploit or PoC public (VulDB), not in KEV. Same advisory covers 10 sibling CLININET CVEs (30045/30046/30052/30053 also unfixed). Tag 'windows' looks wrong: root/uhcapache implies Linux. Did not search social.
- 2026-10-23T22:37:34+00:00 analyst — Re-check: no new primary source. The CNA record (CERT-PL, cveawg JSON) and cert.pl still say affected through 2026.MS3, no fixed version. The notcve.org aggregator shows a second description ending 'fixed in version 2026.MS4', which appears in neither the CVE record nor cert.pl; left unconfirmed, fixed stays empty. CGM page is Polish product page only. File paths still not published. Settle it by checking a CGM or CERT Polska update for 2026.MS4.
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2025-30054

## Documents

- [advisory] CERT Polska: Vulnerabilities in CGM CLININET software https://cert.pl/en/posts/2026/10/CVE-2025-30043/
- [describes] CVE record (CNA CERT-PL) CVE-2025-30054, JSON https://cveawg.mitre.org/api/cve/CVE-2025-30054
- [mentions] NotCVE aggregator: CVE-2025-30054 (shows an unverified 'fixed in 2026.MS4' description) https://notcve.org/cve/CVE-2025-30054

## From the sources

CGM CLININET is vulnerable to local privilege escalation. The service that processes incoming HL7 messages runs with root privileges, but due to incorrect permissions, its scripts and configuration files can be modified by the uhcapache user. An attacker with uhcapache privileges can modify these files to execute arbitrary code as root.


The vulnerability was confirmed to affect versions up to 2026.MS3 but later versions may also be vulnerable.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_