CVE-2025-65791: OS Command Injection
ZoneMinder v1.36.34 is vulnerable to Command Injection in web/views/image.php. The application passes unsanitized user input directly to the exec() function. NOTE: this is disputed by the Supplier because there is no unsanitized user input to web/views/image.php.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-65791?
CVE-2025-65791 has a high severity due to its command injection vulnerability which can lead to remote code execution.
How do I fix CVE-2025-65791?
To fix CVE-2025-65791, sanitize all user inputs before passing them to the exec() function in ZoneMinder.
What versions of ZoneMinder are affected by CVE-2025-65791?
CVE-2025-65791 affects ZoneMinder version 1.36.34.
What type of attack can be performed due to CVE-2025-65791?
CVE-2025-65791 allows attackers to perform command injection attacks which can execute arbitrary commands on the server.
Is there a workaround for CVE-2025-65791?
A potential workaround for CVE-2025-65791 includes disabling features that accept user input until a patch is applied.