CVE-2026-102607

ZoneMinder is vulnerable to authenticated OS command injection (RCE) in versions prior to 1.38.3 , specifically affecting the exportEvents() function. The root cause is the direct concatenation of the unsanitized exportFile request parameter into a shell command executed via PHP's exec() without ...

EUVD-2026-103146

ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, the exportEvents function concatenates the attacker-controlled exportFile request parameter into a shell command without neutralizing shell metacharacters when an authenticated user with View Events...

CVE-2026-102607-ZoneMinder

Security Vulnerability Report: OS Command Injection in ZoneMinder exportEvents Summary An authenticated OS Command Injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HTTP request parameter is passed unsanitized into a shell command executed via PHP's exec,...

PT-2026-116143

ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, the exportEvents function concatenates the attacker-controlled exportFile request parameter into a shell command without neutralizing shell metacharacters when an authenticated user with View Events...