CVE-2026-102607

ZoneMinder is vulnerable to authenticated OS command injection (RCE) in versions prior to 1.38.3 , specifically affecting the exportEvents() function. The root cause is the direct concatenation of the unsanitized exportFile request parameter into a shell command executed via PHP's exec() without ...