CVE-2026-67827 in ZLMediaKit
Summary
by MITRE • 09/22/2026
Incorrect Access Control in the HTTP API module in ZLMediaKit commit 9fd5152 allows remote attackers to achieve Remote Code Execution (RCE) via unauthenticated access to the setServerConfig API endpoint, which permits overwriting the ffmpeg.snap configuration parameter with arbitrary shell commands. These commands are subsequently executed through the getSnap API endpoint with the privileges of the ZLMediaKit process.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/22/2026
The vulnerability identified in the HTTP API module of ZLMediaKit represents a critical failure in access control mechanisms, specifically within the setServerConfig endpoint. This flaw allows unauthenticated remote attackers to manipulate core server configuration parameters without providing valid credentials or session tokens. The root cause lies in the absence of proper authentication checks before processing configuration changes, which violates fundamental security principles regarding privilege separation and input validation. By exploiting this misconfiguration, an attacker can overwrite sensitive settings that dictate how the media streaming service operates under specific conditions.
The technical severity of this vulnerability is amplified by its direct link to Remote Code Execution through a feature known as ffmpeg.snap. This configuration parameter typically defines commands used for capturing snapshots from video streams using FFmpeg. However, due to insufficient sanitization and validation of user-supplied input in the setServerConfig API, attackers can inject arbitrary shell commands into this field instead of legitimate FFmpeg arguments. The system treats these injected strings as executable instructions without verifying their safety or origin, effectively creating a command injection vector that bypasses standard security controls.
The operational impact is severe because the malicious commands are executed with the same privileges as the ZLMediaKit process itself. This means that if the service runs with elevated permissions, such as root access, the attacker gains full control over the underlying operating system. Even in less privileged environments, the ability to execute arbitrary code allows for data exfiltration, lateral movement within a network, or complete compromise of the media server infrastructure. The exploitation chain is straightforward: an unauthenticated user sends a crafted HTTP request to setServerConfig with malicious payload in the ffmpeg.snap field, and subsequently triggers execution via the getSnap endpoint, which processes the snapshot configuration using system shell interpreters.
From a classification perspective, this vulnerability aligns closely with CWE-284 Improper Access Control and CWE-78 OS Command Injection. The lack of authentication on administrative endpoints reflects common misconfigurations in web services where developers assume internal network trust or fail to implement robust identity verification. Furthermore, the execution of unsanitized input as system commands exemplifies classic command injection flaws often seen in applications that interface with external binaries like FFmpeg without adequate parameter escaping or allowlist validation.
In terms of adversary tactics, this vulnerability facilitates initial access and privilege escalation within an ATT&CK framework context. Attackers can leverage this flaw to establish a foothold on the target system by executing custom payloads, potentially downloading additional malware or creating persistent backdoors. The ability to run commands as the service user also aids in defense evasion techniques where attackers might attempt to blend malicious activities with legitimate media processing tasks to avoid detection by security monitoring tools.
Mitigation strategies must prioritize immediate remediation of access control policies. Administrators should enforce strict authentication requirements for all administrative API endpoints, including setServerConfig and getSnap. Implementing role-based access control ensures that only authorized personnel can modify server configurations. Additionally, input validation mechanisms should be strengthened to reject any non-whitelisted characters or commands in configuration fields intended for external tool invocation. Where possible, replacing shell execution with direct library calls or using sandboxed environments for snapshot generation can further reduce the attack surface by isolating potentially dangerous operations from the main process privileges.