CVE-2025-30050: CWE-94 Improper Control of Generation of Code ('Code Injection') in CGM CGM CLININET
Description
CGM CLININET contains a critical code injection vulnerability in its RunCGI.pm component. This flaw allows an attacker on an adjacent network to supply a crafted query parameter that causes the import and execution of an attacker-controlled module with root privileges. The vulnerability is fixed in version 2026.MS3.
CVSS v4.0
Score 9.4critical
Affected software
CGM
CGM CLININET
pkg:github/cgm/CGM-CLININETRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2025-30050 describes a code injection vulnerability in CGM CLININET's RunCGI.pm component. The component dynamically imports a module specified by a user-controlled query parameter, leading to execution of arbitrary code with root privileges. This occurs because untrusted user input is used to determine which module to import without proper validation or sanitization. The vulnerability affects versions prior to 2026.MS3 and requires an attacker to be on an adjacent network to exploit.
Potential Impact
Successful exploitation results in arbitrary code execution with root privileges on the affected system. This can lead to full system compromise, unauthorized access, and control over the CGM CLININET environment.
Mitigation Recommendations
An official fix is available in CGM CLININET version 2026.MS3. Users should upgrade to this version to remediate the vulnerability. Since this is a cloud service, the vendor manages remediation for the hosted environment; customers should verify with the vendor that their instances are updated accordingly.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- CERT-PL
- Date Reserved
- 2025-03-14T14:55:05.984Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Is Cloud Service
- true
Threat ID: 6adb1ece4d27ba8daaeb7e11
Added to database: 10/23/2026, 08:46:06 UTC
Last enriched: 10/23/2026, 09:00:24 UTC
Last updated: 10/23/2026, 09:01:15 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.