An authenticated OS command injection flaw exists in ZoneMinder's event export feature. The exportFile parameter is passed unsanitized into a shell command executed by PHP’s exec(), allowing an authenticated user with View Events permission to run arbitrary operating system commands on the server. This weakness, identified as CWE-78, can compromise system integrity and confidentiality by giving attackers control over the host.

Zoneminder, all versions prior to 1.38.3, are affected. The recommended fix is to upgrade to the latest installer released at zoneminder.com/downloads or obtain the source code from the official GitHub repository to apply the patch.

The vulnerability carries a CVSS score of 8.7, indicating high severity. The EPSS score is 2%, indicating a low exploitation probability, and it is not listed in CISA's KEV catalog. The attack vector is inferred from the description; it is likely remote HTTP access to the event export endpoint, requiring only authentication and a View Events role. Once the attacker controls a user with this permission, they can execute any OS command, posing a significant risk to system availability, integrity, and confidentiality.