The issue arises from XML parsers in several CompuGroup Medical products that are configured to resolve external entities. When an XML document containing externally referenced entities is processed, the parser may fetch and include data from arbitrary file paths or URLs. This type of vulnerability, identified as CWE‑611 (XML External Entity), opens the door to XML External Entity (XXE) attacks, allowing an attacker to read sensitive files, access internal network resources, and—based on the description—an attacker may also potentially execute arbitrary code if the application runs with significant privileges.

Affected vendors are CompuGroup Medical, specifically the Infantia, Phronesis, Profim, and Venere product lines. Version information is not disclosed in the advisory; administrators should inspect the latest release notes from the vendor to confirm which builds contain the fix.

The CVSS score of 7.2 classifies the weakness as high. EPSS data are unavailable, and the vulnerability is not listed in CISA’s KEV catalog. The most likely attack vector is via remote delivery of malicious XML—through update manifests or network responses that the application automatically processes. Successful exploitation would give an attacker the ability to read arbitrary files or cause denial of service, and it is inferred that if the application runs privileged, it could lead to remote code execution. The vulnerability is classified as CWE‑611.