CVE-2026-76060
Received Received - Intake

Authenticated OS Command Injection in ZoneMinder via exportFile Parameter

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: ICS-CERT

Description
An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HTTP request parameter is passed unsanitized into a shell command executed via PHP's exec(), allowing any authenticated user with View Events permission to execute arbitrary operating system commands on the server.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-28
Last Modified
2026-08-28
Generated
2026-08-28
AI Q&A
2026-08-28
EPSS Evaluated
N/A
NVD
CVE-2026-76060

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
zoneminder zoneminder From 1.37.48 (exc) to 1.38.3 (exc)
zoneminder zoneminder *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-76060 is an authenticated OS command injection flaw in ZoneMinder, a video surveillance software. The issue exists in the event export/download feature where a monitor's name is improperly sanitized before being used in shell commands. An attacker with monitor creation or editing rights can name a monitor with embedded shell metacharacters, such as a single quote followed by a command. When any authenticated user with Events=View permission exports events for that monitor, the malicious command executes as the web server user (www-data).

Detection Guidance

Check ZoneMinder version with 'zmupdate.pl --version' or 'dpkg -l zoneminder'. Inspect web/includes/download_functions.php for unsanitized exec() calls. Monitor for unusual command execution patterns in system logs like /var/log/syslog or /var/log/auth.log.

Impact Analysis

This vulnerability allows attackers to execute arbitrary operating system commands on the server with the privileges of the web server user (www-data). This can lead to full remote code execution, unauthorized access to sensitive data, system compromise, or disruption of surveillance services. Attackers could install malware, exfiltrate data, or pivot to other systems on the network.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security and privacy requirements. Organizations may face legal penalties, loss of customer trust, and reputational damage. Compliance with these regulations requires ensuring systems are patched and protected against such vulnerabilities.

Mitigation Strategies

Upgrade ZoneMinder to version 1.38.3 or later immediately. If upgrading is not possible, restrict access to authenticated users with View Events permission. Disable event export functionality temporarily until patched. Monitor network traffic for suspicious activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-76060. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart