CVE-2026-76060: OS Command Injection in PayRange API
An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HTTP request parameter is passed unsanitized into a shell command executed via PHP's exec(), allowing any authenticated user with View Events permission to execute arbitrary operating system commands on the server.
Other sources
ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, downloadEvents() manually wraps a monitor Name value in single quotes instead of using escapeshellarg() before placing it in shell commands when a user with monitor-create or monitor-edit permission stores a monitor Name containing shell metacharacters and a user with Events View permission exports that monitor's events. In this attack mechanism, the stored monitor Name reaches both the ffmpeg concatenation command and the tar or zip archive command and breaks out of manual quoting. Arbitrary commands execute as the web server user. This issue is fixed in version 1.38.3.
— OSV
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ZoneMinderto a version that resolves this vulnerability.Fixed in 1.38.3
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
Any authenticated ZoneMinder user account that has the View Events permission can exploit it. No user interaction is required once the attacker is authenticated.
What level of access can an attacker gain?
An attacker can execute arbitrary operating-system commands on the ZoneMinder server through the event export functionality. The reported impact includes high confidentiality, integrity, and availability impact.
Is remote exploitation possible?
Yes. The reported attack vector is network-based, and exploitation uses the exportFile HTTP request parameter. The attacker must first authenticate with an account that has View Events permission.
How can I determine whether an environment is exposed?
Review whether ZoneMinder event export is available and identify accounts or roles granted the View Events permission. Any such authenticated account may be able to submit a crafted exportFile parameter.