CVE-2026-30971 Details
Description
ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.39.2, 1.38.2, and 1.36.40, ZoneMinder interpolates an unvalidated monitor Device field into shell commands in PHP and Perl control paths when an authenticated user with monitor-create or monitor-edit permission saves a Local monitor whose Device Path contains shell metacharacters and the monitor control or startup path runs. In this attack mechanism, the stored Device value reaches Perl qx() and backtick execution before zmdc.pl argument detainting, while separate PHP command paths use bypassable escapeshellcmd defenses. The attacker can execute arbitrary commands as the web server user. This vulnerability is fixed in 1.39.2, 1.38.2, and 1.36.40.
A command injection vulnerability has been identified in ZoneMinder, a closed-circuit television software application, prior to versions 1.39.2, 1.38.2, and 1.36.40. The issue allows authenticated users with monitor creation or editing permissions to execute arbitrary commands on the server. This is achieved by injecting shell metacharacters into the 'Device Path' field of a Local monitor. The vulnerability arises because the Device field is directly interpolated into shell commands without proper validation or sanitization, particularly in PHP and Perl control paths. As a result, the injected commands are executed with the privileges of the web server user.
Users can update to ZoneMinder versions 1.39.2, 1.38.2, or 1.36.40, where this vulnerability has been fixed. The patch includes input validation to reject invalid device paths, output sanitization for shell commands, and corrections in the affected Perl and PHP files.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 16, 2026CISA-ADP
Assessed Oct 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-g66m-77fq-79v9 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/ZoneMinder/zoneminder/commit/419846c8750c3f45b9b8a1df8cd49c189a14dc03 | [email protected] | Source CodeVendor |
| https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-g66m-77fq-79v9 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ZoneMinder | <= 1.39.1 (semver) <= 1.38.1 (semver) <= 1.36.39 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 16, 2026 | New CVE Received | [email protected] |
| Oct 16, 2026 | CVE Modified | CISA-ADP |