CVE-2026-67827: ZLMediaKit vulnerability
Incorrect Access Control in the HTTP API module in ZLMediaKit commit 9fd5152 allows remote attackers to achieve Remote Code Execution (RCE) via unauthenticated access to the setServerConfig API endpoint, which permits overwriting the ffmpeg.snap configuration parameter with arbitrary shell commands. These commands are subsequently executed through the getSnap API endpoint with the privileges of the ZLMediaKit process.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
An attacker needs remote network access to the ZLMediaKit HTTP API. No authentication is required to call the affected setServerConfig endpoint.
How does exploitation result in code execution?
The attacker can overwrite the ffmpeg.snap configuration parameter with a shell command through setServerConfig. Calling getSnap subsequently executes that command with the privileges of the ZLMediaKit process.
Which deployments are exposed?
Deployments are exposed if their HTTP API is remotely reachable and include the affected behavior described for commit 9fd5152. The provided information does not state whether the API is enabled or remotely accessible by default.
What can be done if patching is not immediately possible?
Restrict remote access to the ZLMediaKit HTTP API so untrusted users cannot reach setServerConfig or getSnap. Review the ffmpeg.snap setting for unexpected shell commands and investigate use of those API endpoints.