CVE-2026-67827

Incorrect Access Control in the HTTP API module in ZLMediaKit commit 9fd5152 allows remote attackers to achieve Remote Code Execution RCE via unauthenticated access to the setServerConfig API endpoint, which permits overwriting the ffmpeg.snap configuration parameter with arbitrary shell commands...

PT-2026-96286

Name of the Vulnerable Software and Affected Versions ZLMediaKit versions prior to commit 9fd5152 Description Incorrect access control in the HTTP API module allows unauthenticated remote attackers to achieve Remote Code Execution RCE. An attacker can access the 'setServerConfig' API endpoint to...

CVE-2026-67827

Incorrect Access Control in the HTTP API module in ZLMediaKit commit 9fd5152 allows remote attackers to achieve Remote Code Execution RCE via unauthenticated access to the setServerConfig API endpoint, which permits overwriting the ffmpeg.snap configuration parameter with arbitrary shell commands...

CVE-2026-67827

Incorrect Access Control in the HTTP API module in ZLMediaKit commit 9fd5152 allows remote attackers to achieve Remote Code Execution RCE via unauthenticated access to the setServerConfig API endpoint, which permits overwriting the ffmpeg.snap configuration parameter with arbitrary shell commands...

EUVD-2026-84193

Incorrect Access Control in the HTTP API module in ZLMediaKit commit 9fd5152 allows remote attackers to achieve Remote Code Execution RCE via unauthenticated access to the setServerConfig API endpoint, which permits overwriting the ffmpeg.snap configuration parameter with arbitrary shell commands...

CVE-2026-67827: Improper Control of Generation of Code

Incorrect Access Control in the HTTP API module in ZLMediaKit commit 9fd5152 allows remote attackers to achieve Remote Code Execution RCE via unauthenticated access to the setServerConfig API endpoint, which permits overwriting the ffmpeg.snap configuration parameter with arbitrary shell commands...

CVE-2026-67827

The ZLMediaKit software (commit 9fd5152 ) is vulnerable to Remote Code Execution (RCE) due to an Incorrect Access Control flaw in its HTTP API module. An unauthenticated remote attacker can access the setServerConfig API endpoint to overwrite the ffmpeg.snap configuration parameter with arbitrary...