CVE-2026-102608

Deferred Deferred - Pending Action

Command Injection in ZoneMinder via Monitor Name

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: GitHub, Inc.

Description

ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, downloadEvents() manually wraps a monitor Name value in single quotes instead of using escapeshellarg() before placing it in shell commands when a user with monitor-create or monitor-edit permission stores a monitor Name containing shell metacharacters and a user with Events View permission exports that monitor's events. In this attack mechanism, the stored monitor Name reaches both the ffmpeg concatenation command and the tar or zip archive command and breaks out of manual quoting. Arbitrary commands execute as the web server user. This issue is fixed in version 1.38.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-16

Last Modified

2026-10-16

Generated

2026-10-17

AI Q&A

2026-10-17

EPSS Evaluated

N/A

NVD

CVE-2026-102608

EUVD

EUVD-2026-103151

Affected Vendors & Products

Vendor	Product	Version / Range
ZoneMinder	zoneminder	>= 1.37.48, < 1.38.3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

ZoneMinder before 1.38.3 has a vulnerability where the downloadEvents() function improperly handles monitor names containing shell metacharacters. Instead of using proper escaping with escapeshellarg(), it manually wraps the name in single quotes. This allows attackers with monitor-edit or monitor-create permissions to inject arbitrary shell commands. When users with Events View permission export events, the malicious monitor name is used in ffmpeg and archive commands, leading to command execution as the web server user.

Detection Guidance

Check ZoneMinder version with 'zmupdate.pl --version' or 'dpkg -l | grep zoneminder'. If version is below 1.38.3, the system is vulnerable. Inspect monitor names for shell metacharacters like semicolons or backticks in the web interface.

Impact Analysis

If exploited, this vulnerability allows attackers to execute arbitrary commands on the server running ZoneMinder as the web server user. This could lead to full system compromise, data theft, or unauthorized access to the CCTV system. Attackers could view, modify, or delete recordings, disable monitoring, or pivot to other systems on the network.

Compliance Impact

This vulnerability could severely impact compliance with GDPR and HIPAA by enabling unauthorized access to sensitive video data. GDPR requires protection of personal data, and HIPAA mandates safeguards for protected health information. A breach could result in legal penalties, fines, and reputational damage due to compromised surveillance footage containing personal or medical information.

Mitigation Strategies

Upgrade ZoneMinder to version 1.38.3 or later immediately. Remove or sanitize monitor names containing shell metacharacters. Restrict user permissions to only necessary roles.

Hi! I’m here to help you understand CVE-2026-102608. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70