ZoneMinder is a free open‑source CCTV application. An authenticated user with monitor‑create or monitor‑edit permission can store a monitor name containing shell metacharacters. When another authenticated user with Events View permission exports that monitor’s events, the stored name is inserted into ffmpeg, tar, or zip commands without proper escaping, allowing arbitrary shell command execution as the web server user. This is an OS Command Injection flaw (CWE‑78).

The vulnerability exists in ZoneMinder 1.38.2 and all earlier releases. It was addressed in the 1.38.3 release. No other specific vendors or product variants are listed as affected.

The CVSS score of 9.0 indicates critical severity. The EPSS score is not available, so the current exploitation probability cannot be quantified here, but the flaw permits attackers to run any command with web server privileges. The vulnerability is not listed in the CISA KEV catalog. An attacker would need to be authenticated with at least monitor‑create or monitor‑edit permissions and, separately (but potentially the same account), Events View permissions to trigger the exploit.