What is GHSA-cwv2-4c7h-2v4g?

GHSA-cwv2-4c7h-2v4g is a security advisory published by GitHub Security Advisories with Critical severity. CGM CLININET is vulnerable to Code Injection in the RunCGI.pm component, which dynamically...

Which CVE IDs does GHSA-cwv2-4c7h-2v4g cover?

GHSA-cwv2-4c7h-2v4g covers the following CVE IDs: CVE-2025-30050. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

GHSA-cwv2-4c7h-2v4gCritical

CGM CLININET is vulnerable to Code Injection in the RunCGI.pm component, which dynamically...

Vendor

GitHub Security Advisories

Published

October 23, 2026

Last Modified

October 23, 2026

🔗 CVE IDs covered (1)

CVE-2025-30050 →

📋 Description

CGM CLININET is vulnerable to Code Injection in the RunCGI.pm component, which dynamically imports the module specified as a query parameter and executes code from untrusted data provided by the user. An attacker from adjacent network can supply a crafted query parameter to have an attacker-controlled module imported which results in arbitrary code execution with root privileges.

This issue was fixed in version 2026.MS3

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2025-30050
https://cert.pl/en/posts/2026/10/CVE-2025-30043
https://www.cgm.com/pol_pl/products/szpital/cgm-clininet.html
https://github.com/advisories/GHSA-cwv2-4c7h-2v4g