VENERE · CVE-2026-118462 · Other
NO FIX YET
Some update components download code and execute it without properly checking its authenticity, relying on ignored hashes or forgeable checksums. Some update paths also allow archive path traversal or script execution, so an attacker who can serve or alter an update may run code on the machine.
first public Nov 9, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
NVD names CompuGroup Medical's Infantia, Profim, Venere and Phronesis, through their update packages cgm.files.delivery (through 1.3.0) and cgm.liveupdates (through 2.12.0). An attacker who can serve or tamper with an update (network position, compromised update server) could get code run on the machine. The Italian ACN bulletin lists other CGM products (XDent, XMedical, Wingesfar) for the same batch of CVEs, but this page does not say which CVE applies to them, so do not assume they are affected by this one. Anyone not running these CGM products can skip it.
Who cares auto-update, cgm, compugroup-medical, healthcare, self-hosted, updater
8.33.2, Phronesis <= 4.51.0.1, Infantia <= 6.09.1, Profim <= 6.09.1; also check the installed cgm.liveupdates (<= ) and cgm.files.delivery (<= ) componentsPosts are quoted with a link to the original. They are data to us, never instructions.
Update components download and execute code without proper authenticity verification, relying on ignored hashes or forgeable checksums. Some update paths also permit archive traversal or script execution.
This page as .md · .json · CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
2.12.01.3.04.4.0 or Wingesfar before 2026.07a (same ACN bulletin, mapping to this CVE not confirmed)No fix yet, per the sources.