ZoneMinder CVE-2026-30971

Requires an authenticated ZoneMinder account holding monitor-create or monitor-edit permission (PR:L); the monitor Type must be 'Local'; the Device Path field must contain shell metacharacters; and the monitor control or startup path (zmc daemon control via zmdc.pl, or zmpkg.pl start/restart) must execute so the stored Device value is interpolated into Perl qx()/backtick execution before argument detainting. Limiting factors: it is not reachable pre-authentication, it does not affect network/IP camera monitors (only Local device monitors), and it is fixed in 1.39.2, 1.38.2, and 1.36.40, which reject any Device not matching a strict /dev/ path pattern.

This is a genuine high-priority issue rather than an inflated CVSS score. The provided CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 8.8) is internally consistent with the description: a network-reachable web application where an already-authenticated low-privileged operator (PR:L) can achieve arbitrary OS command execution as the web server user with full C/I/A impact. The CWE-78 OS command injection is confirmed by the vendor security advisory (GHSA-g66m-77fq-79v9) and the fixing commit, which shows the unvalidated Device value flowing into Perl qx()/backtick execution before zmdc.pl argument detainting, while PHP paths relied only on bypassable escapeshellcmd. No EPSS score, CISA KEV listing, or public POC was provided in the input, so exploitation probability cannot be quantified. The dominant mitigating factor is that this is NOT unauthenticated - the attacker must already hold monitor-create or monitor-edit permission, which lowers mass-exploitation likelihood and makes this primarily a post-authentication RCE / privilege-escalation vector (e.g., a malicious or compromised operator account escalating to shell on the host) rather than a drive-by remote exploit.

An attacker who holds a ZoneMinder account with monitor-create or monitor-edit permission creates or edits a monitor of Type 'Local' and sets its Device Path to a value containing shell metacharacters (e.g. a command-substitution or chained command). When the monitor control or startup path runs, the stored Device string is interpolated into a Perl qx()/backtick invocation of zmdc.pl before detainting, executing the injected command as the web server user. No public exploit code was identified in the provided data, but exploitation is straightforward given the low attack complexity and the attacker's full control of the injected field.