Description
An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HTTP request parameter is passed unsanitized into a shell command executed via PHP's exec(), allowing any authenticated user with View Events permission to execute arbitrary operating system commands on the server.
Published: 2026-08-27
Score: 8.7 High
EPSS: 2.3% Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

An authenticated OS command injection flaw exists in ZoneMinder’s event export feature. The exportFile parameter is passed unsanitized into a shell command executed by PHP’s exec(), allowing an authenticated user with View Events permission to run arbitrary operating system commands on the server. This weakness, identified as CWE‑78, can compromise system integrity and confidentiality by giving attackers control over the host.

Affected Systems

Zoneminder, all versions prior to 1.38.3, are affected. The recommended fix is to upgrade to the latest installer released at zoneminder.com/downloads or obtain the source code from the official GitHub repository to apply the patch.

Risk and Exploitability

The vulnerability carries a CVSS score of 8.7, indicating high severity. No EPSS score is available, and it is not listed in CISA’s KEV catalog. The likely attack vector is remote HTTP access to the event export endpoint, requiring only authentication and a View Events role. Once the attacker controls a user with this permission, they can execute any OS command, posing a significant risk to system availability, integrity, and confidentiality.

Generated by OpenCVE AI on August 28, 2026 at 08:16 UTC.

Remediation

Vendor Solution

Zoneminder recommends upgrading to version 1.38.3 or later by downloading the installer for your system at: https://zoneminder.com/downloads .  Users may also get the source code from Zoneminder's Github: https://github.com/ZoneMinder/zoneminder .   For more details refer to Zoneminder's security advisories at: https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-88m4-hrgp-m9v3 .

OpenCVE Recommended Actions

  • Upgrade Zoneminder to version 1.38.3 or later using the installer from the official download site
  • If an upgrade is temporarily unavailable, disable the event export functionality or remove the exportFile parameter from the request handling to block command execution
  • Reduce privileges by removing the View Events permission from user accounts or restrict the permission to trusted administrators

Generated by OpenCVE AI on August 28, 2026 at 08:16 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 28 Aug 2026 07:15:00 +0000

Type Values Removed Values Added
First Time appeared Zoneminder
Zoneminder zoneminder
Vendors & Products Zoneminder
Zoneminder zoneminder

Thu, 27 Aug 2026 18:00:00 +0000

Type Values Removed Values Added
Description An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HTTP request parameter is passed unsanitized into a shell command executed via PHP's exec(), allowing any authenticated user with View Events permission to execute arbitrary operating system commands on the server.
Title OS Command Injection in PayRange API
Weaknesses CWE-78
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Zoneminder Zoneminder
cve-icon MITRE

Status: PUBLISHED

Assigner: icscert

Published:

Updated: 2026-08-27T20:29:05.262Z

Reserved: 2026-08-18T20:49:11.814Z

Link: CVE-2026-76060

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-28T00:18:14.273

Modified: 2026-08-28T00:18:14.273

Link: CVE-2026-76060

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-28T08:30:17Z

Weaknesses
  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')