CVE-2026-102607: ZoneMinder: Authenticated OS Command Injection (RCE) via Export Feature
ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, the exportEvents() function concatenates the attacker-controlled exportFile request parameter into a shell command without neutralizing shell metacharacters when an authenticated user with View Events or View Snapshots permission submits an event export request with a crafted exportFile value, a valid CSRF token, and exportDetail enabled. The affected components are exportEvents(), exportFile, web/ajax/event.php, web/skins/classic/includes/exportfunctions.php. In this attack mechanism, the crafted exportFile value reaches the trailing directory argument of a tar or zip command executed by exec(). The attacker can execute arbitrary operating system commands as the web server user. This issue is fixed in version 1.38.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ZoneMinderto a version that resolves this vulnerability.Fixed in 1.38.3
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated ZoneMinder user with View Events or View Snapshots permission can exploit it. The attacker also needs a valid CSRF token and must submit an event export request with exportDetail enabled.
What access does successful exploitation provide?
Successful exploitation allows arbitrary operating system command execution as the web server user. This can affect confidentiality, integrity, and availability at the privilege level of that account.
Which deployments are affected?
ZoneMinder versions prior to 1.38.3 are affected. The vulnerable export path involves web/ajax/event.php and web/skins/classic/includes/export_functions.php, where exportFile is incorporated into tar or zip commands.
What should be done if immediate patching is not possible?
The provided data does not identify a workaround. Limit access to accounts with View Events or View Snapshots permission and restrict access to the event export functionality until upgrading to 1.38.3.