CERT Polska lists 11 CGM CLININET flaws, several still unfixed

CERT Polska lists 11 CGM CLININET flaws, several still unfixed

23 October 2026: CERT Polska has published eleven vulnerabilities in CGM CLININET, a hospital information system made by CGM, including an unauthenticated path to list and download patient documents and several ways to run code as root on the application server. Version 2026.MS3 fixes six of them. Five, including two root code execution paths, are confirmed in every version up to 2026.MS3 and may affect later ones.

Not yet independently verified. CERT Polska gives no CVSS scores and we have not found a CGM advisory for these flaws; CERT Polska also says later versions than 2026.MS3 may be vulnerable to the unfixed issues. We will update this when it can be confirmed, and remove this note.

Fixed in 2026.MS3

• CVE-2025-30043, missing authentication on the /DocManagment path: an unauthenticated attacker on the adjacent network can list patient documents and download them.
• CVE-2025-30047, deserialization of untrusted data in the Java-serialised HTTP API used by the administrative module: anyone on the same local network can send a crafted object and run code as root.
• CVE-2025-30050, code injection in RunCGI.pm, which imports a module named in a query parameter: an attacker on the adjacent network gets root code execution.
• CVE-2025-30051, the production database password and the RabbitMQ broker credentials stored in SysIO.pl with file permissions that let any local account read them.
• CVE-2025-30049, user passwords stored as unsalted MD5 hashes (fixed in 2026.MS1 and 2026.MS3).

Still open in every version up to 2026.MS3

• CVE-2025-30046: the processes that exchange HL7 messages with other hospital systems run as root while parsing that untrusted input, so anyone able to send HL7 data to them can run code as root.
• CVE-2025-30045: code injection in ConvExpr, which turns Perl expressions into RTF document content; an authenticated high-privileged user can run code as root.
• CVE-2025-30054: the HL7 service's scripts and configuration can be edited by the uhcapache account, a local route from the web server user to root.
• CVE-2025-30052: the rsyncd service trusts clients by source IP address alone, so a spoofed address can edit files.
• CVE-2025-30053: the cgm-updater process listens on an open port with no authentication.
• CVE-2025-58403: reflected cross-site scripting that lets a crafted link steal a session.

What a hospital IT team can do now

Almost every flaw needs network reach, not the internet, which puts the weight on segmentation. The HL7 interfaces are the hardest to protect because they exist to accept data from laboratory, imaging and admission systems; restricting them to the specific hosts that feed them, at the firewall rather than in CLININET, narrows CVE-2025-30046 to those machines. The rsyncd and cgm-updater ports should not be reachable from clinical workstation networks at all. Upgrading to 2026.MS3 closes the unauthenticated document download and the deserialization route, and the move off unsalted MD5 means users' passwords should be reset once the upgrade is in, since old hashes may already have been copied.

The flaws were reported by Maciej Kazulak and disclosed through CERT Polska, the incident response team within NASK, the Polish national research institute. Our hospital management software category lists 13 products and our electronic medical records category 5.

Sources

• CERT Polska: Vulnerabilities in CGM CLININET software, 23 October 2026