CVE-2025-30057

Authenticated RCE with uhcapache privileges in ConvertToPDF PUBLISHED

Description (CNA)

In UHCRTFDoc, the filename parameter can be exploited to execute arbitrary code via command injection into the system() call in the ConvertToPDF function.

Affected (CNA)

Vendor / product	Versions
CGM / CGM CLININET	affected 0 before 2024.MS4

CWE

CWE-94

References

https://cert.pl/en/posts/2025/08/CVE-2025-2313/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.