ZoneMinder EUVD-2026-103146

Exploitation requires an authenticated ZoneMinder session whose user holds the 'View Events' OR 'View Snapshots' permission, a valid CSRF token for the export request, and the 'exportDetail' option enabled on that request; the crafted payload must be placed in the exportFile request parameter handled by web/ajax/event.php and exportEvents() in web/skins/classic/includes/export_functions.php. Limiting factors: this is NOT unauthenticated (PR:L) - the attacker needs valid low-privilege credentials or an authenticated victim's session, the CSRF-token requirement blocks blind cross-site forgery without a leaked/valid token, and exportDetail must be enabled, so instances not exposing event export to lower-privilege roles are not exploitable by those roles. Affected only prior to version 1.38.3.

This is a genuine OS command injection (CWE-78) confirmed by the vendor's own GHSA advisory (GHSA-7j62-cjxp-3cj5) and the fix commits, where the attacker-controlled exportFile parameter is concatenated into a tar/zip command passed to exec(). The provided CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) is internally consistent with the description: network-reachable web endpoint, low attacker complexity, and full C/I/A impact via arbitrary command execution as the web server user. The key limiting signal is PR:L - exploitation is NOT unauthenticated; it requires a valid session with 'View Events' or 'View Snapshots' permission plus a valid CSRF token and the exportDetail option enabled, which meaningfully narrows the attacker population to authenticated (possibly low-privilege) users or anyone who can ride an authenticated session. No EPSS score, KEV listing, or POC was provided in the input, so there is no evidence of active exploitation or public exploit code; the real-world risk is therefore 'high severity, authenticated-only, no current exploitation signal.' Treat it as a priority patch for internet-exposed ZoneMinder instances (where credential or session compromise is plausible) but not an emergency drop-everything issue absent any exploitation data. Note explicitly: EPSS is MISSING and KEV/POC status is UNKNOWN from the input, so the probability-of-exploitation dimension cannot be assessed.

An authenticated ZoneMinder user holding only View Events or View Snapshots permission submits an event export request with exportDetail enabled and a crafted exportFile value containing shell metacharacters plus a valid CSRF token. The malicious string reaches the trailing directory argument of the tar/zip command run by exec(), executing arbitrary OS commands as the web server user. No public exploit code was identified in the provided data, but the single-parameter injection and low complexity make weaponization straightforward for anyone with a valid low-privilege account.