CISA 2026-08-25

Zoneminder

CVE-2026-76060

Machine-generated analysis · WAYSCloud LLM

An authenticated user with View Events permission can exploit an OS command injection via the exportFile parameter.

Context

Zoneminder is the affected product. The advisory states that an authenticated OS command injection vulnerability exists in the event export functionality, allowing arbitrary operating system commands to be executed as the web server user. The vulnerability affects versions 1.37.48 and 1.38.3, and the vendor recommends upgrading to version 1.38.3 or later.

Operator considerations

Check: Verify the installed Zoneminder version.
Isolate: Restrict View Events permission to trusted accounts.
Patch: Upgrade to Zoneminder 1.38.3 or later.
Log: Monitor exportFile requests and command execution logs for anomalies.

From Cybersecurity and Infrastructure Security Agency ↗

Successful exploitation of this vulnerability could result in full Remote Code Execution (RCE) as the web server user.

The following versions of Zoneminder are affected:

Zoneminder 1.37.48|1.38.3

Vendor

Equipment

Zoneminder

Zoneminder

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Critical Infrastructure Sectors: Information Technology

Countries/Areas Deployed: Worldwide

Company Headquarters Location: United States

An authenticated OS Command Injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HTTP request parameter is passed unsanitized into a shell command executed via PHP's exec(), allowing any authenticated user with View Events permission to execute arbitrary operating system commands on the server.

Zoneminder

Relevant CWE: CWE-78 Improper Neutralization of Special Elements used in an ...

Read the full advisory on CISA →