Is CVE-2025-30050 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-30050 being exploited in the wild.

How severe is CVE-2025-30050?

Informational severity, published 23 October 2026.

Which products and versions are affected?

CGM CLININET all versions before 2026.MS3.

Is there a fix for CVE-2025-30050?

Yes: fixed in 2026.MS3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-30050 attacked?

It is attacked from the adjacent network, in a web application.

Am I affected by CVE-2025-30050?

Check whether you run CGM CLININET at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-30050: CGM CLININET code injection in RunCGI.pm

CVE-2025-30050 · Severity: info · Published 2026-10-23

CGM CLININET is a hospital information system that manages patient records, clinical workflows, and medical data across healthcare facilities. An attacker on the same local network can exploit a code injection flaw in the RunCGI.pm component by supplying a crafted query parameter, leading to arbitrary code execution with root privileges and potential compromise of all patient data and hospital operations.

Technologies: CGM CLININET. Vendors: CGM.

Quick answers

Is CVE-2025-30050 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-30050 being exploited in the wild.
How severe is CVE-2025-30050?: Informational severity, published 23 October 2026.
Which products and versions are affected?: CGM CLININET all versions before 2026.MS3.
Is there a fix for CVE-2025-30050?: Yes: fixed in 2026.MS3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-30050 attacked?: It is attacked from the adjacent network, in a web application.
Am I affected by CVE-2025-30050?: Check whether you run CGM CLININET at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 2026.MS3

Technical details

The RunCGI.pm component dynamically imports Perl modules specified via untrusted user-supplied query parameters without proper validation, allowing arbitrary code execution. An attacker within the adjacent network (same local network or directly routable network) can craft a request that causes an attacker-controlled module to be imported and executed with root-level privileges. This is a classic code injection vulnerability (CWE-94) with no authentication requirement and direct network accessibility.

Affected products

CGM CLININET all versions before 2026.MS3

Timeline

2026-10-23: disclosed
2026-10-23: advisory: CERT Polska vulnerability report

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.