CVE-2026-102607

Deferred Deferred - Pending Action

Command Injection in ZoneMinder via exportEvents

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: GitHub, Inc.

Description

ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, the exportEvents() function concatenates the attacker-controlled exportFile request parameter into a shell command without neutralizing shell metacharacters when an authenticated user with View Events or View Snapshots permission submits an event export request with a crafted exportFile value, a valid CSRF token, and exportDetail enabled. The affected components are exportEvents(), exportFile, web/ajax/event.php, web/skins/classic/includes/export_functions.php. In this attack mechanism, the crafted exportFile value reaches the trailing directory argument of a tar or zip command executed by exec(). The attacker can execute arbitrary operating system commands as the web server user. This issue is fixed in version 1.38.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-16

Last Modified

2026-10-16

Generated

2026-10-17

AI Q&A

2026-10-17

EPSS Evaluated

N/A

NVD

CVE-2026-102607

EUVD

EUVD-2026-103146

Affected Vendors & Products

Vendor	Product	Version / Range
ZoneMinder	zoneminder	< 1.38.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability in ZoneMinder allows an authenticated user with specific permissions to execute arbitrary operating system commands on the server. The issue occurs when the exportEvents() function processes a crafted exportFile parameter in an event export request, which is then passed unsafely to a shell command like tar or zip.

Detection Guidance

Check ZoneMinder versions prior to 1.38.3. Look for suspicious export events with crafted exportFile parameters in logs. Monitor for unexpected command execution by the web server user.

Impact Analysis

An attacker could gain full control of the server running ZoneMinder, steal sensitive data, install malware, or disrupt services. Since the attack is performed as the web server user, it may also allow lateral movement to other systems if permissions are misconfigured.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA requirements for data protection and access controls. Organizations using vulnerable versions may face compliance violations, legal penalties, and reputational damage.

Mitigation Strategies

Upgrade ZoneMinder to version 1.38.3 or later immediately. Restrict access to authenticated users with View Events or View Snapshots permissions. Review and remove unnecessary permissions for web server users.

Hi! I’m here to help you understand CVE-2026-102607. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70