Description
ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, the exportEvents() function concatenates the attacker-controlled exportFile request parameter into a shell command without neutralizing shell metacharacters when an authenticated user with View Events or View Snapshots permission submits an event export request with a crafted exportFile value, a valid CSRF token, and exportDetail enabled. The affected components are exportEvents(), exportFile, web/ajax/event.php, web/skins/classic/includes/export_functions.php. In this attack mechanism, the crafted exportFile value reaches the trailing directory argument of a tar or zip command executed by exec(). The attacker can execute arbitrary operating system commands as the web server user. This issue is fixed in version 1.38.3.
Published: 2026-10-16
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

ZoneMinder’s exportEvents() feature allows an authenticated user with View Events or View Snapshots permission to supply a crafted exportFile value that is concatenated into a shell command without escaping metacharacters. This leads to the execution of arbitrary operating system commands as the web server user, providing full system compromise. The vulnerability is classified under CWE-78, indicating an OS command injection weakness.

Affected Systems

ZoneMinder versions prior to 1.38.3 are affected. The vulnerable components include exportEvents(), exportFile, web/ajax/event.php, and web/skins/classic/includes/export_functions.php.

Risk and Exploitability

With a CVSS score of 8.8, the vulnerability is considered high severity. EPSS data is not available, and the issue is not listed in the CISA KEV catalog. Exploitation requires a valid CSRF token, the exportDetail option enabled, and an authenticated session; thus the attack vector is web‑based through the export feature. A successful exploit would allow an attacker to run arbitrary commands as the web server process.

Generated by OpenCVE AI on October 16, 2026 at 20:41 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade ZoneMinder to version 1.38.3 or later, which removes the shell command concatenation bug.
  • If an immediate upgrade is not possible, disable the exportEvents() feature by removing or commenting out the exportFile handling code and disabling exportDetail in the configuration to prevent shell command execution.
  • Restrict user permissions so that only trusted administrators have View Events or View Snapshots access, thereby limiting the number of users who can trigger the export file request.

Generated by OpenCVE AI on October 16, 2026 at 20:41 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 17 Oct 2026 20:45:00 +0000

Type Values Removed Values Added
First Time appeared Zoneminder
Zoneminder zoneminder
Vendors & Products Zoneminder
Zoneminder zoneminder

Fri, 16 Oct 2026 19:45:00 +0000

Type Values Removed Values Added
Description ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, the exportEvents() function concatenates the attacker-controlled exportFile request parameter into a shell command without neutralizing shell metacharacters when an authenticated user with View Events or View Snapshots permission submits an event export request with a crafted exportFile value, a valid CSRF token, and exportDetail enabled. The affected components are exportEvents(), exportFile, web/ajax/event.php, web/skins/classic/includes/export_functions.php. In this attack mechanism, the crafted exportFile value reaches the trailing directory argument of a tar or zip command executed by exec(). The attacker can execute arbitrary operating system commands as the web server user. This issue is fixed in version 1.38.3.
Title ZoneMinder: Authenticated OS Command Injection (RCE) via Export Feature
Weaknesses CWE-78
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Zoneminder Zoneminder
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-10-16T19:29:58.131Z

Reserved: 2026-09-29T14:18:02.921Z

Link: CVE-2026-102607

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-10-16T20:17:17.097

Modified: 2026-10-16T20:17:17.220

Link: CVE-2026-102607

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-17T20:30:13Z

Weaknesses
  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')