CVE-2026-76060: OS Command Injection in PayRange API
An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HTTP request parameter is passed unsanitized into a shell command executed via PHP's exec(), allowing any authenticated user with View Events permission to execute arbitrary operating system commands on the server.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ZoneMinderto a version that resolves this vulnerability.Fixed in 1.38.3
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
Any authenticated ZoneMinder user account that has the View Events permission can exploit it. No user interaction is required once the attacker is authenticated.
What level of access can an attacker gain?
An attacker can execute arbitrary operating-system commands on the ZoneMinder server through the event export functionality. The reported impact includes high confidentiality, integrity, and availability impact.
Is remote exploitation possible?
Yes. The reported attack vector is network-based, and exploitation uses the exportFile HTTP request parameter. The attacker must first authenticate with an account that has View Events permission.
How can I determine whether an environment is exposed?
Review whether ZoneMinder event export is available and identify accounts or roles granted the View Events permission. Any such authenticated account may be able to submit a crafted exportFile parameter.