CVE-2026-102608

9.0Critical

Published 16 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

9.0Critical

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: Required
Impact: Full C/I/A compromise
Weakness: CWE-78

Impact

An authenticated attacker with monitor creation or edit privileges can execute arbitrary commands as the web server user. Exploitation requires a victim with Events View permissions to export events for the maliciously named monitor.

Root cause

The downloadEvents function manually wraps monitor names in single quotes instead of using escapeshellarg, enabling shell metacharacter breakouts in downstream ffmpeg and archive commands.

Affected systems

ZoneMinder versions prior to 1.38.3

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Fix & remediation

Upgrade ZoneMinder to version 1.38.3 or later. If immediate patching is not possible, restrict monitor edit/create privileges and prevent users from exporting monitor events.

shell

$ sudo apt-get update && sudo apt-get install --only-upgrade zoneminder

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, downloadEvents() manually wraps a monitor Name value in single quotes instead of using escapeshellarg() before placing it in shell commands when a user with monitor-create or monitor-edit permission stores a monitor Name containing shell metacharacters and a user with Events View permission exports that monitor's events. In this attack mechanism, the stored monitor Name reaches both the ffmpeg concatenation command and the tar or zip archive command and breaks out of manual quoting. Arbitrary commands execute as the web server user. This issue is fixed in version 1.38.3.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-102608