ZoneMinder Command Injection via Export Function in Versions Before 1.38.3
Authenticated users can execute arbitrary OS commands in ZoneMinder by manipulating the export file parameter, a flaw rated high severity.
Key points
- The flaw exists in the exportEvents() function before version 1.38.3.
- Attackers need valid credentials and a CSRF token to exploit the issue.
- Arbitrary code runs with the privileges of the web server user.
ZoneMinder, an open-source CCTV application, contains a high-severity command injection vulnerability affecting versions prior to 1.38.3. Security researchers identified that the exportEvents() function fails to neutralise shell metacharacters when processing user input. This defect allows authenticated users with specific permissions to execute arbitrary operating system commands on the host machine. The issue stems from improper input sanitisation within the web interface components.
Root cause
The vulnerability arises because the exportEvents() function concatenates the attacker-controlled exportFile request parameter directly into a shell command. According to the NVD record, this occurs without neutralising shell metacharacters. The affected code resides in web/ajax/event.php and web/skins/classic/includes/export_functions.php. When an export request is processed, the unvalidated input reaches the trailing directory argument of a tar or zip command. This execution happens via the exec() function, granting the attacker control over the command line.
Attack path
To exploit this flaw, an attacker must first obtain valid authentication credentials for the ZoneMinder application. They require either View Events or View Snapshots permission. The attacker then submits an event export request containing a crafted exportFile value. This request must include a valid CSRF token and have exportDetail enabled. Once these conditions are met, the crafted value is passed to the shell command, allowing arbitrary code execution as the web server user.
Affected versions
- ZoneMinder versions prior to 1.38.3 are vulnerable.
- The issue is resolved in version 1.38.3.
Mitigation
- Upgrade ZoneMinder to version 1.38.3 or later immediately.
- Restrict access to the export functionality if upgrading is not immediately possible.
- Monitor web server logs for unexpected command executions.
Signals worth monitoring
Teams should examine web server access logs for unusual patterns in export requests, particularly those with long or encoded parameters. Look for unexpected process spawns originating from the web server user account, such as tar or zip commands running in non-standard directories. Alert on any outbound network connections initiated by the web application process, which may indicate data exfiltration or reverse shell activity. Check for new files created in temporary directories or user home folders, as attackers often use these locations for staging tools or storing exfiltrated data.
What to do and how to stay safe: ZoneMinder
- Verify the installed ZoneMinder version and compare it against the fixed release.
- Once the vendor provides an update, apply it to all exposed instances.
- Review authentication logs for any unauthorised access attempts to the export feature.
- Monitor system processes for unexpected command executions by the web server user.
Step-by-step guide: Out-of-band patches: what small businesses need to know
General security guidance from the Firewall Pulse newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-102607?
The National Vulnerability Database rates the severity as 8.8, which is classified as HIGH.
Which specific functions are affected by this flaw?
The exportEvents() function and related components in event.php and export_functions.php are affected.
Can unauthenticated users exploit this vulnerability?
No, an attacker requires valid authentication and specific permissions to exploit this issue.
