OS Command Injection in PayRange API
Priority MEDIUM 44CWE-78Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-78.
Summary
An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HTTP request parameter is passed unsanitized into a shell command executed via PHP's exec(), allowing any authenticated user with View Events permission to execute arbitrary operating system commands on the server.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.02373 83rd percentileScored 2026-11-07
Fix Fixed Zoneminder (Zoneminder): 1.38.3
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| ZoneMinder | Zoneminder | 1.37.48 to before 1.38.3 | 1.38.3 | Patch available | CNA |
- Zoneminder VendorZoneMinder Affected 1.37.48 to before 1.38.3 Fixed in 1.38.3 Patch available CNA
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:zoneminder:zoneminder:*:*:*:*:*:*:*:* | — | — | ZoneMinder |
- cpe:2.3:a:zoneminder:zoneminder:*:*:*:*:*:*:*:* Versions — — ·ZoneMinder
Remediation
- Fix · CNA Zoneminder (Zoneminder) Fixed in 1.38.3
Timeline
- 2026-10-02 Threatist record created from CVE-2026-76060
References
Other 5
- https://zoneminder.com/downloads
- https://github.com/ZoneMinder/zoneminder
- https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-88m4-hrgp-m9v3
- https://www.cisa.gov/news-events/ics-advisories/icsa-26-237-02
- https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-237-02.json
More ZoneMinder vulnerabilities
- TI-2025-40444 ZoneMinder v1.36.34 is vulnerable to Command Injection in web/views/image.php. CVSS 3.1CRITICAL 9.8
- TI-2023-11269 ZoneMinder vulnerable to Missing Authorization CVSS 3.1CRITICAL 9.8
- TI-2022-18665 Database log access in ZoneMinder CVSS 3.1CRITICAL 9.1
- TI-2022-12167 ZoneMinder before 1.36.13 allows remote code execution via an invalid language. CVSS 3.1CRITICAL 9.8
- TI-2024-34403 Boolean-based SQL Injection in ZoneMinder v1.37.* <= 1.37.64 CVSS 3.1CRITICAL 10.0
- TI-2024-29012 ZoneMinder Time-based SQL Injection CVSS 3.1CRITICAL 9.8
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences