CVE-2026-30971: ZoneMinder: Authenticated RCE via command injection in monitor Device Path
ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.39.2, 1.38.2, and 1.36.40, ZoneMinder interpolates an unvalidated monitor Device field into shell commands in PHP and Perl control paths when an authenticated user with monitor-create or monitor-edit permission saves a Local monitor whose Device Path contains shell metacharacters and the monitor control or startup path runs. In this attack mechanism, the stored Device value reaches Perl qx() and backtick execution before zmdc.pl argument detainting, while separate PHP command paths use bypassable escapeshellcmd defenses. The attacker can execute arbitrary commands as the web server user. This vulnerability is fixed in 1.39.2, 1.38.2, and 1.36.40.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ZoneMinderto a version that resolves this vulnerability.Fixed in 1.39.2 - Upgrade
Upgrade
ZoneMinderto a version that resolves this vulnerability.Fixed in 1.38.2 - Upgrade
Upgrade
ZoneMinderto a version that resolves this vulnerability.Fixed in 1.36.40
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated ZoneMinder user who has permission to create or edit monitors can exploit it. The vulnerable workflow requires saving a Local monitor with shell metacharacters in its Device Path.
What conditions are required for command execution?
The malicious Device Path must be stored on a Local monitor, and the monitor control or startup path must subsequently run. Commands execute as the web server user.
Which releases contain the fix?
The issue is fixed in ZoneMinder versions 1.39.2, 1.38.2, and 1.36.40. Versions prior to those releases are affected according to the advisory.
What can be done before patching?
Restrict monitor creation and editing permissions to trusted users, especially for Local monitors. Review Device Path values for shell metacharacters and avoid running control or startup paths for suspicious monitors.