CVE-2026-102608

The ZoneMinder CCTV software (prior to version 1.38.3 ) is vulnerable to OS Command Injection in the downloadEvents() function within download_functions.php. The root cause is the manual wrapping of a monitor name in single quotes instead of using escapeshellarg(), allowing shell metacharacters t...