ZoneMinder: Authenticated OS command injection via event export
Summary
ZoneMinder, an open-source CCTV application, contains an OS command injection flaw in the event export function. An authenticated user with the View Events or View Snapshots permission can supply a crafted exportFile value that is concatenated into a tar or zip shell command. Successful exploitation allows arbitrary operating system commands to run as the web server user, which can serve as a foothold into the internal network.
Affected
- ZoneMinder versions before 1.38.3 (CVE record). VulDB states up to 1.38.2; the affected range is not fully consistent across sources.
- Conditions: valid user with View Events or View Snapshots permission, valid CSRF token, exportDetail enabled.
Fixed in
- Fixed in ZoneMinder 1.38.3 (vendor and CVE record).
- Fix commits: 548ed87d47a49c17b4c842f6fee8a08660deb427 and 605f962b7b6ba7f5780b3e6715b5418b8b2addca.
- Distribution package fix versions: Unknown.
Workaround
- No vendor workaround known.
- Remove View Events and View Snapshots permissions from users who do not need them.
- Restrict the ZoneMinder web interface to LAN or VPN access.
Exploitation
- Not listed in the CISA KEV catalog; no confirmed in-the-wild exploitation found.
- Public proof-of-concept status is conflicting; no verified working PoC confirmed.
- CISA SSVC: exploitation status poc, automatable: no, technical impact: total.
Our recommendation
- Update ZoneMinder to 1.38.3 or a newer release as a priority.
- If an update is not immediately possible, apply the restrictions above.
- Review user accounts and remove shared or unnecessary CCTV logins.
- Do not expose the ZoneMinder web interface directly to the internet.
- Review web server logs for unusual event export requests.
Public exploits
Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.
- Proof of concept on GitHub (1 repositories)
d4kw1n/CVE-2026-102607-ZoneMinder
Research sources
- CVE record fix commit 548ed87 github.com
- CVE record fix commit 605f962 github.com
- ZoneMinder release 1.38.3 github.com
- GHSA-7j62-cjxp-3cj5 advisory github.com
- VulDB CVE-2026-102607 vuldb.com
- Ubuntu CVE-2026-102607 ubuntu.com
- Debian security tracker zoneminder security-tracker.debian.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 15:57.
Original description (NVD)
ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, the exportEvents() function concatenates the attacker-controlled exportFile request parameter into a shell command without neutralizing shell metacharacters when an authenticated user with View Events or View Snapshots permission submits an event export request with a crafted exportFile value, a valid CSRF token, and exportDetail enabled. The affected components are exportEvents(), exportFile, web/ajax/event.php, web/skins/classic/includes/export_functions.php. In this attack mechanism, the crafted exportFile value reaches the trailing directory argument of a tar or zip command executed by exec(). The attacker can execute arbitrary operating system commands as the web server user. This issue is fixed in version 1.38.3.
NVD references (5)
- https://github.com/ZoneMinder/zoneminder/commit/548ed87d47a49c17b4c842f6fee8a08660deb427
- https://github.com/ZoneMinder/zoneminder/commit/605f962b7b6ba7f5780b3e6715b5418b8b2addca
- https://github.com/ZoneMinder/zoneminder/releases/tag/1.38.3
- https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-7j62-cjxp-3cj5
- https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-7j62-cjxp-3cj5
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.