CVE-2026-102607 in ZoneMinder
Summary
by MITRE • 10/16/2026
ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, the exportEvents() function concatenates the attacker-controlled exportFile request parameter into a shell command without neutralizing shell metacharacters when an authenticated user with View Events or View Snapshots permission submits an event export request with a crafted exportFile value, a valid CSRF token, and exportDetail enabled. The affected components are exportEvents(), exportFile, web/ajax/event.php, web/skins/classic/includes/export_functions.php. In this attack mechanism, the crafted exportFile value reaches the trailing directory argument of a tar or zip command executed by exec(). The attacker can execute arbitrary operating system commands as the web server user. This issue is fixed in version 1.38.3.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/16/2026
ZoneMinder is an open-source closed-circuit television software application widely used for video surveillance and monitoring. A critical security vulnerability exists within versions prior to 1.38.3, specifically affecting the exportEvents() function located in web/ajax/event.php and supported by logic in web/skins/classic/includes/export_functions.php. This flaw constitutes a command injection vulnerability that allows authenticated users with View Events or View Snapshots permissions to execute arbitrary operating system commands under the context of the web server user account. The root cause lies in the improper neutralization of shell metacharacters when concatenating attacker-controlled input into system-level commands.
The technical mechanism involves the exportFile request parameter, which is directly concatenated into a trailing directory argument for either tar or zip archive creation utilities executed via PHP's exec() function. When an authenticated user submits an event export request with exportDetail enabled and provides a valid CSRF token to bypass anti-CSRF protections, they can inject malicious shell commands through crafted values in the exportFile parameter. Because the input is not sanitized against special characters such as semicolons or ampersands that are interpreted by the underlying operating system's command interpreter, an attacker can terminate the intended archive operation and append additional commands for execution.
This vulnerability falls under CWE-78 Improper Neutralization of Special Elements used in an OS Command commonly known as Operating System Command Injection. From a threat modeling perspective aligned with MITRE ATT&CK techniques, this aligns with T1059 Command and Scripting Interpreter where the attacker leverages system utilities to execute arbitrary code on the host machine. The impact is severe because it grants remote command execution capabilities without requiring administrative privileges or network-level access beyond what is already granted by standard user authentication. An adversary could potentially use this foothold to escalate privileges, exfiltrate sensitive surveillance data stored in accessible directories, pivot into other internal systems, or establish persistence mechanisms on the compromised server.
Mitigation strategies primarily involve upgrading ZoneMinder to version 1.38.3 or later where the issue has been resolved through proper input validation and output encoding practices. In environments where immediate patching is not feasible, administrators should implement strict access controls limiting who can invoke event export functions with detailed options enabled. Additionally, deploying a Web Application Firewall may help detect and block requests containing suspicious shell metacharacters in parameter values. Regular security audits of third-party integrations and continuous monitoring for anomalous process executions originating from the web server user context are also recommended to identify potential exploitation attempts early.