ZoneMinder versions prior to 1.39.2, 1.38.2, and 1.36.40 allow an authenticated user with monitor-create or monitor-edit rights to embed shell metacharacters in a monitor’s Device Path field. This value is later interpolated into shell commands in PHP and Perl control paths, creating a command injection flaw (CWE-78). The flaw permits arbitrary command execution as the web server user, representing a high‑risk remote code execution vulnerability.

The vulnerability affects ZoneMinder software distributed by the ZoneMinder community. All releases before 1.39.2, before 1.38.2, and before 1.36.40 are impacted. Users running these versions should verify their installation against the references and upgrade accordingly.

With a CVSS score of 8.8, the exploit presents a significant security risk; EPSS data is not available, and the flaw is not currently listed in CISA KEV. The attack vector requires an authenticated session with sufficient permissions to edit or create monitors; the attacker must supply a Device Path containing shell characters, cause the monitor control or startup path to execute, and then the arbitrary commands run under the web server user. No post‑deployment network exposure is necessary beyond web access.