CVE-2026-102607

8.8High

Published 16 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

8.8High

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: Full C/I/A compromise
Weakness: CWE-78

Impact

Authenticated attackers with View Events or View Snapshots permissions can execute arbitrary shell commands as the web server user. They need valid account credentials and a CSRF token to trigger a malicious event export request.

Root cause

The exportEvents() function directly concatenates the unescaped exportFile parameter into a tar or zip shell command executed via exec().

Affected systems

ZoneMinder prior to 1.38.3

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Fix & remediation

Upgrade ZoneMinder to version 1.38.3 or later. If you cannot patch immediately, revoke View Events and View Snapshots permissions from untrusted accounts or restrict web access to trusted administrators.

shell

$ sudo apt-get update && sudo apt-get install --only-upgrade zoneminder

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, the exportEvents() function concatenates the attacker-controlled exportFile request parameter into a shell command without neutralizing shell metacharacters when an authenticated user with View Events or View Snapshots permission submits an event export request with a crafted exportFile value, a valid CSRF token, and exportDetail enabled. The affected components are exportEvents(), exportFile, web/ajax/event.php, web/skins/classic/includes/export_functions.php. In this attack mechanism, the crafted exportFile value reaches the trailing directory argument of a tar or zip command executed by exec(). The attacker can execute arbitrary operating system commands as the web server user. This issue is fixed in version 1.38.3.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-102607