ZoneMinder
CVE-2026-76060
HIGH
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable via web interface with View Events permission (PR:L, AV:N); no scope change as impact is contained to the ZoneMinder host, consistent with CVSS 4.0 SC:N/SI:N/SA:N.
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
Lifecycle Timeline
7DescriptionCVE.org
An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HTTP request parameter is passed unsanitized into a shell command executed via PHP's exec(), allowing any authenticated user with View Events permission to execute arbitrary operating system commands on the server.
AnalysisAI
OS command injection in ZoneMinder's event export functionality enables any authenticated user holding the View Events permission to execute arbitrary commands on the underlying server. The exportFile HTTP request parameter is passed without sanitization into PHP's exec() function, granting attackers full control over server-side command execution. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid authenticated ZoneMinder session with at minimum the View Events permission; unauthenticated access is not possible per the CVSS 4.0 PR:L designation. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H reflects a network-accessible, low-complexity attack requiring only low-level authentication and no user interaction, scoring 8.7. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor-released patch documented in GitHub Security Advisory GHSA-88m4-hrgp-m9v3 (https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-88m4-hrgp-m9v3) and verify the exact fixed release version at the ZoneMinder downloads page (https://zoneminder.com/downloads); no specific patched version number was confirmed in the provided data and must be independently verified before deployment. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Conduct inventory of all ZoneMinder deployments and document user accounts with View Events permission; immediately restrict View Events permission to only essential personnel and verify via access logs. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Zoneminder
View allincludes/functions.php in ZoneMinder Video Server 1.24.0, 1.25.0, and earlier allows remote attackers to execute arbitra
ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and An
ZoneMinder before 1.36.13 allows remote code execution via an invalid language. Rated critical severity (CVSS 9.8), this
Multiple directory traversal vulnerabilities in ZoneMinder 1.24.x before 1.24.4 allow remote attackers to read arbitrary
Information disclosure and authentication bypass vulnerability exists in the Apache HTTP Server configuration bundled wi
Command injection in ZoneMinder v1.36.34 video surveillance system via web/views/image.php. Unsanitized user input enabl
SQL injection vulnerability in Zoneminder 1.30 and earlier allows remote attackers to execute arbitrary SQL commands via
ZoneMinder is a free, open source closed-circuit television software application. Rated critical severity (CVSS 9.8), th
ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and An
ZoneMinder before 1.32.3 has SQL Injection via the ajax/status.php filter[Query][terms][0][cnj] parameter. Rated critica
ZoneMinder before 1.32.3 has SQL Injection via the skins/classic/views/control.php groupSql parameter, as demonstrated b
daemonControl in includes/functions.php in ZoneMinder before 1.32.3 allows command injection via shell metacharacters. R
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today