ZLMediaKit exposes an HTTP API endpoint, setServerConfig, that does not enforce access control. An unauthenticated remote attacker can send a request to this endpoint to overwrite the ffmpeg.snap configuration parameter with an arbitrary shell command. The overwritten command is later executed when the getSnap API endpoint is invoked, running with the privileges of the ZLMediaKit process. This flaw permits a remote attacker to arbitrarily execute code and fully compromise the host, affecting confidentiality, integrity, and availability.

The vulnerable component is part of the open‑source ZLMediaKit media server, specifically commit 9fd5152. No specific release versions are listed, so any instance using that commit or later snapshots that have not yet applied the fix is potentially impacted.

The CVSS score is 9.8 and the EPSS indicates a low exploitation probability (< 1%). The flaw is not listed in CISA KEV. The likely attack vector is unauthenticated HTTP requests to the setServerConfig endpoint, implying that any host reachable over the network and running a vulnerable ZLMediaKit instance is susceptible. Because the command execution is performed with the service’s process privileges, an attacker can pivot to higher privilege actions on the host.