CVE-2026-30971

Deferred Deferred - Pending Action

Command Injection in ZoneMinder

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: GitHub, Inc.

Description

ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.39.2, 1.38.2, and 1.36.40, ZoneMinder interpolates an unvalidated monitor Device field into shell commands in PHP and Perl control paths when an authenticated user with monitor-create or monitor-edit permission saves a Local monitor whose Device Path contains shell metacharacters and the monitor control or startup path runs. In this attack mechanism, the stored Device value reaches Perl qx() and backtick execution before zmdc.pl argument detainting, while separate PHP command paths use bypassable escapeshellcmd defenses. The attacker can execute arbitrary commands as the web server user. This vulnerability is fixed in 1.39.2, 1.38.2, and 1.36.40.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-16

Last Modified

2026-10-16

Generated

2026-10-17

AI Q&A

2026-10-17

EPSS Evaluated

N/A

NVD

CVE-2026-30971

EUVD

EUVD-2026-103154

Affected Vendors & Products

Vendor	Product	Version / Range
ZoneMinder	zoneminder	< 1.36.40
ZoneMinder	zoneminder	>= 1.38.0, < 1.38.2
ZoneMinder	zoneminder	>= 1.39.0, < 1.39.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

ZoneMinder versions before 1.39.2, 1.38.2, and 1.36.40 have a flaw where an authenticated user with monitor-create or monitor-edit permissions can inject shell metacharacters into a monitor's Device field. This unvalidated input is interpolated into shell commands in PHP and Perl control paths, allowing arbitrary command execution as the web server user.

Detection Guidance

Check ZoneMinder version with 'zmupdate.pl --version' or 'dpkg -l | grep zoneminder'. If running versions before 1.39.2, 1.38.2, or 1.36.40, the system is vulnerable. Inspect monitor Device Path fields for shell metacharacters like semicolons or backticks in the web interface.

Impact Analysis

An attacker with authenticated access could execute arbitrary commands on the system running ZoneMinder, potentially gaining control over the server, accessing sensitive data, or disrupting services. This could lead to full system compromise.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA requirements for data protection and access controls. Non-compliance risks include legal penalties and reputational damage.

Mitigation Strategies

Upgrade ZoneMinder to version 1.39.2, 1.38.2, or 1.36.40 immediately. Remove shell metacharacters from monitor Device Path fields. Restrict monitor-create and monitor-edit permissions to trusted users only.

Hi! I’m here to help you understand CVE-2026-30971. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70