CVE-2026-102607 Details
Description
ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, the exportEvents() function concatenates the attacker-controlled exportFile request parameter into a shell command without neutralizing shell metacharacters when an authenticated user with View Events or View Snapshots permission submits an event export request with a crafted exportFile value, a valid CSRF token, and exportDetail enabled. The affected components are exportEvents(), exportFile, web/ajax/event.php, web/skins/classic/includes/export_functions.php. In this attack mechanism, the crafted exportFile value reaches the trailing directory argument of a tar or zip command executed by exec(). The attacker can execute arbitrary operating system commands as the web server user. This issue is fixed in version 1.38.3.
A command injection vulnerability has been identified in ZoneMinder versions prior to 1.38.3, specifically within the event export feature. The issue arises in the exportEvents() function, where the exportFile parameter is concatenated into a shell command without proper sanitization. This vulnerability allows authenticated users with View Events or View Snapshots permissions to execute arbitrary commands on the server as the web server user (www-data). The vulnerability was discovered during a whitebox source code audit and has been fixed in ZoneMinder version 1.38.3.
Users can update to ZoneMinder version 1.38.3 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 16, 2026CISA-ADP
Assessed Oct 19, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-7j62-cjxp-3cj5 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/ZoneMinder/zoneminder/commit/548ed87d47a49c17b4c842f6fee8a08660deb427 | [email protected] | Source CodeVendor |
| https://github.com/ZoneMinder/zoneminder/commit/605f962b7b6ba7f5780b3e6715b5418b8b2addca | [email protected] | Source CodeVendor |
| https://github.com/ZoneMinder/zoneminder/releases/tag/1.38.3 | [email protected] | Release NotesVendor |
| https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-7j62-cjxp-3cj5 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ZoneMinder | <= 1.38.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 19, 2026 | CVE Modified | CISA-ADP |
| Oct 16, 2026 | New CVE Received | [email protected] |