---
id: "CVE-2026-118462"
page: "https://infrastack.ai/live/CVE-2026-118462"
kind: "vulnerability"
aliases: ["CVE-2026-118462"]
title: "CompuGroup Medical update components (cgm.liveupdates, cgm.files.delivery) run downloaded code without verifying it"
severity: "critical"
cvss: 9.2
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Venere", "fixed": [], "affected": "<= 8.33.2", "ecosystem": "vendor"}, {"name": "Phronesis", "fixed": [], "affected": "<= 4.51.0.1", "ecosystem": "vendor"}, {"name": "Infantia", "fixed": [], "affected": "<= 6.09.1", "ecosystem": "vendor"}, {"name": "Profim", "fixed": [], "affected": "<= 6.09.1", "ecosystem": "vendor"}]
ecosystems: []
tags: ["auto-update", "cgm", "compugroup-medical", "healthcare", "other", "self-hosted", "updater"]
not_affected_if: []
published_at: "2026-11-09T12:16:37+00:00"
first_seen_at: "2026-11-09T12:26:23+00:00"
updated_at: "2026-11-09T12:29:13+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118462", "first_seen_at": "2026-11-09T12:26:23+00:00"}, {"source": "analyst", "url": "https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical", "first_seen_at": "2026-11-09T12:29:13+00:00", "cites": ["https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical", "https://nvd.nist.gov/vuln/detail/CVE-2026-118462"]}]
exploit_sources: []
---

# CompuGroup Medical update components (cgm.liveupdates, cgm.files.delivery) run downloaded code without verifying it

Link for people: https://infrastack.ai/live/CVE-2026-118462 (this .md is for agents)

Some update components download code and execute it without properly checking its authenticity, relying on ignored hashes or forgeable checksums. Some update paths also allow archive path traversal or script execution, so an attacker who can serve or alter an update may run code on the machine.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Venere affected <= 8.33.2 fixed no fixed version listed
- vendor:Phronesis affected <= 4.51.0.1 fixed no fixed version listed
- vendor:Infantia affected <= 6.09.1 fixed no fixed version listed
- vendor:Profim affected <= 6.09.1 fixed no fixed version listed

## How to check

Compare installed versions with the ACN list: Venere <= 8.33.2, Phronesis <= 4.51.0.1, Infantia <= 6.09.1, Profim <= 6.09.1; also check the installed cgm.liveupdates (<= 2.12.0) and cgm.files.delivery (<= 1.3.0) components. Also check if you run XDent/XMedical 4.4.0 or Wingesfar before 2026.07a (same ACN bulletin, mapping to this CVE not confirmed).

## Timeline

- 2026-11-09T12:26:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118462
- 2026-11-09T12:29:13+00:00 analyst https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical — NVD (via WebFetch of API) points to ACN bulletin on CompuGroup Medical; ACN lists affected versions, no fixed versions (except Wingesfar 2026.07a), advises updating via CGM support channels; no PoC/exploitation reported. Vendor CGM press release not read (web-cli out of credits). Per-CVE product mapping and cgm.* package ranges come from NVD summary only; nothing marked verified.

## Documents

- [advisory] CSIRT Italia: vulnerabilità in prodotti CompuGroup Medical https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-compugroup-medical
- [describes] NVD CVE-2026-118462 https://nvd.nist.gov/vuln/detail/CVE-2026-118462

## From the sources

Update components download and execute code without proper authenticity verification, relying on ignored hashes or forgeable checksums. Some update paths also permit archive traversal or script execution.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_