GHSA-8fw2-wh82-vv4h: ZoneMinder 1.37.x Path Traversal via files view
Published Sep 28, 2026
·Updated
ZoneMinder versions 1.37.0 before 1.38.0 contain a path traversal vulnerability in the files view that allows authenticated users to read arbitrary files. The path parameter is not properly validated before being passed to outputfile, enabling attackers with Events view permission to access sensitive files like configuration files containing database credentials.
Affected Software
1 affected component
ZoneMinder Zoneminder>=1.37.0<1.38.0
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ZoneMinderto a version that resolves this vulnerability.Fixed in 1.38.0
Event History
Sep 28, 2026
CVE Published
via OSV·10:00 PM
Data Sourced
via OSV·10:00 PM
DescriptionSeverityWeakness