Read the docs
TI-2026-75999 Aliases CVE-2026-102608GHSA-v9cj-6fp2-33q4

OS command injection in ZoneMinder event export via monitor name

Priority MEDIUM 41CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

ZoneMinder from 1.37.48 before 1.38.3 is affected. The downloadEvents() function wraps a monitor name in single quotes instead of using escapeshellarg(), so shell metacharacters in the name break out of the quoting (CWE-78). A user with monitor-create or monitor-edit permission can store such a name, and a user with Events View permission who exports that monitor's events causes arbitrary commands to run as the web server user.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, downloadEvents() manually wraps a monitor Name value in single quotes instead of using escapeshellarg() before placing it in shell commands when a user with monitor-create or monitor-edit permission stores a monitor Name containing shell metacharacters and a user with Events View permission exports that monitor's events. In this attack mechanism, the stored monitor Name reaches both the ffmpeg concatenation command and the tar or zip archive command and breaks out of manual quoting. Arbitrary commands execute as the web server user. This issue is fixed in version 1.38.3.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00287 21st percentileScored 2026-11-07
Fix Fixed zoneminder (ZoneMinder): 1.38.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ZoneMinderzoneminder1.37.48 to before 1.38.31.38.3Patch availableCNA
  • zoneminder VendorZoneMinder Affected 1.37.48 to before 1.38.3 Fixed in 1.38.3 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:zoneminder:zoneminder:*:*:*:*:*:*:*:*——ZoneMinder
  • cpe:2.3:a:zoneminder:zoneminder:*:*:*:*:*:*:*:* Versions — — ·ZoneMinder

Remediation

Upgrade ZoneMinder to version 1.38.3, which fixes this issue.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA zoneminder (ZoneMinder) Fixed in 1.38.3

Timeline

  1. 2026-10-18 Threatist record created from CVE-2026-102608
  2. 2026-10-18 Alias added: GHSA-v9cj-6fp2-33q4
  3. 2026-10-18 Priority changed: MEDIUM → LOW
  4. 2026-10-19 CISA SSVC decision points changed
  5. 2026-10-19 Priority changed: LOW → MEDIUM

References

Other 6

  • TI-2025-40444 ZoneMinder v1.36.34 is vulnerable to Command Injection in web/views/image.php. CVSS 3.1CRITICAL 9.8
  • TI-2023-11269 ZoneMinder vulnerable to Missing Authorization CVSS 3.1CRITICAL 9.8
  • TI-2022-18665 Database log access in ZoneMinder CVSS 3.1CRITICAL 9.1
  • TI-2022-12167 ZoneMinder before 1.36.13 allows remote code execution via an invalid language. CVSS 3.1CRITICAL 9.8
  • TI-2024-34403 Boolean-based SQL Injection in ZoneMinder v1.37.* <= 1.37.64 CVSS 3.1CRITICAL 10.0
  • TI-2024-29012 ZoneMinder Time-based SQL Injection CVSS 3.1CRITICAL 9.8
See all 95 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences