GHSA-88m4-hrgp-m9v3: ZoneMinder: Authenticated OS Command Injection via unsanitized Monitor Name in event export (download_functions.php)

Q: Who can exploit this issue in practice?

Exploitation requires two permission sets: a user who can create or edit monitors must first store a monitor name containing shell metacharacters, and a user with Events View permission must export events for that monitor. The same user may be able to perform both steps if they hold both sets of permissions.

Q: Does this require direct server access or a special deployment configuration?

No direct server access is described. The vulnerable path is the event export functionality reached through an HTTP request, and successful commands run as the web server user.

Q: Which installations are affected and what is the remediation?

ZoneMinder versions prior to 1.38.3 are affected. Upgrade to version 1.38.3, which replaces the unsafe manual quoting with appropriate shell argument escaping.

Q: What should be reviewed if an immediate upgrade is not possible?

Review monitor names for shell metacharacters, especially names created or changed by users with monitor-create or monitor-edit permissions. Restrict monitor creation/editing and Events View/export access to trusted users until the issue is remediated.

Published Aug 27, 2026

Updated

An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HTTP request parameter is passed unsanitized into a shell command executed via PHP's exec(), allowing any authenticated user with View Events permission to execute arbitrary operating system commands on the server.

Other sources

ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, downloadEvents() manually wraps a monitor Name value in single quotes instead of using escapeshellarg() before placing it in shell commands when a user with monitor-create or monitor-edit permission stores a monitor Name containing shell metacharacters and a user with Events View permission exports that monitor's events. In this attack mechanism, the stored monitor Name reaches both the ffmpeg concatenation command and the tar or zip archive command and breaks out of manual quoting. Arbitrary commands execute as the web server user. This issue is fixed in version 1.38.3.

— OSV

Affected Software

1 affected component

ZoneMinder Zoneminder<1.38.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ZoneMinder to a version that resolves this vulnerability.
Fixed in 1.38.3

Event History

Aug 27, 2026

CVE Published

via OSV·08:29 PM

Data Sourced

via OSV·08:29 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue in practice?

Exploitation requires two permission sets: a user who can create or edit monitors must first store a monitor name containing shell metacharacters, and a user with Events View permission must export events for that monitor. The same user may be able to perform both steps if they hold both sets of permissions.

Does this require direct server access or a special deployment configuration?

No direct server access is described. The vulnerable path is the event export functionality reached through an HTTP request, and successful commands run as the web server user.

Which installations are affected and what is the remediation?

ZoneMinder versions prior to 1.38.3 are affected. Upgrade to version 1.38.3, which replaces the unsafe manual quoting with appropriate shell argument escaping.

What should be reviewed if an immediate upgrade is not possible?

Review monitor names for shell metacharacters, especially names created or changed by users with monitor-create or monitor-edit permissions. Restrict monitor creation/editing and Events View/export access to trusted users until the issue is remediated.

GHSA-88m4-hrgp-m9v3: ZoneMinder: Authenticated OS Command Injection via unsanitized Monitor Name in event export (download_functions.php)

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue in practice?

Does this require direct server access or a special deployment configuration?

Which installations are affected and what is the remediation?

What should be reviewed if an immediate upgrade is not possible?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue in practice?

Does this require direct server access or a special deployment configuration?

Which installations are affected and what is the remediation?

What should be reviewed if an immediate upgrade is not possible?