EUVD-2026-84193
GHSA-m78q-27gx-3rwr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed HTTP API port
-
DeliveryCall setServerConfig unauthenticated
-
ExploitOverwrite ffmpeg.snap with shell command
-
ExecutionInvoke getSnap to trigger execution
-
ImpactRCE as ZLMediaKit process
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Code injection prevention, sandbox exec
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the ZLMediaKit HTTP API service and that the setServerConfig/getSnap endpoints are accessible without authentication - the CVE's core is that access control on these API endpoints is missing or broken, so no credentials or user interaction are needed (PR:N/UI:N). The practical limiting factor is exposure: the HTTP API port must be reachable by the attacker (e.g., server exposed to the internet or a hostile network segment rather than firewalled to trusted clients). The flaw is pinned to commit 9fd5152; deployments on other builds should verify whether the same unauthenticated config-write-then-execute path exists. Code execution runs at the privilege level of the ZLMediaKit process. |
| Impact | This is a genuine top-priority vulnerability. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8 Critical) describes remote, unauthenticated, low-complexity code execution with no user interaction - the worst-case profile, and it is fully consistent with the description (broken access control on the HTTP API allows overwriting the ffmpeg.snap config with shell commands executed via getSnap). The signals do, however, diverge: EPSS is only 0.21% (11th percentile), the CVE is NOT in CISA KEV, and no public exploit code was identified (the sole reference is the vendor GHSA advisory, not a POC repo). This low EPSS/no-KEV picture indicates that despite the trivial exploitability, there is no evidence of at-scale exploitation yet - likely a function of the recent disclosure and the fact that only a specific commit (9fd5152) is named rather than released versions. No SSVC decision data was provided in the input. Net: treat as high priority (unauth RCE, easy to weaponize once the config-write chain is understood) even though automated-exploitation telemetry is currently low. |
| Exploit ScenarioDerived | An attacker who can reach the ZLMediaKit HTTP API port over the network sends an unauthenticated request to the setServerConfig endpoint, setting ffmpeg.snap to a malicious shell command. They then invoke the getSnap endpoint, which executes that command with the privileges of the ZLMediaKit process, yielding remote code execution. No public POC was identified at time of analysis, but the two-step chain is straightforward to reproduce from the description. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 24, 2026
Unauthenticated remote code execution affects ZLMediaKit builds based on commit 9fd5152, where broken access control in the HTTP API allows a remote attacker to overwrite the ffmpeg.snap snapshot configuration parameter with arbitrary shell commands through the setServerConfig endpoint, which are then executed with the privileges of the ZLMediaKit process when getSnap is invoked. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8), no credentials or user interaction are required - the only practical prerequisite is network reachability to the exposed HTTP API service. Exploitation has not been confirmed as active (not in CISA KEV) and no public exploit code was identified at time of analysis; the EPSS score is low at 0.21% (11th percentile), but the unauthenticated, full-compromise nature of the flaw makes it a top-priority fix for any internet-facing or hostile-network-reachable deployment.
RemediationAI
No exact vendor fix version is specified in the available input data, so the authoritative remediation guidance must be taken from the ZLMediaKit security advisory GHSA-qh3r-f727-ww9m (https://github.com/ZLMediaKit/ZLMediaKit/security/advisories/GHSA-qh3r-f727-ww9m) and the NVD record for CVE-2026-67827; upgrade to the patched build referenced there, and if you are on or near commit 9fd5152 treat the instance as exploitable until proven fixed. If an upgraded build is not immediately deployable, the highest-value compensating control is to eliminate unauthenticated reachability of the management API: bind the HTTP API to localhost or a management-only interface, firewall the API port to trusted administrative hosts only (this breaks any internet-facing or multi-tenant API consumers), and place an authenticating reverse proxy in front of setServerConfig and getSnap (clients that rely on anonymous API calls will need credentials added). Where snapshot/thumbnail generation is not required, disabling the snapshot feature removes the code-execution sink entirely at the cost of losing ffmpeg.snap functionality. Additional containment includes running the ZLMediaKit process under a dedicated low-privilege account with a restricted filesystem and outbound network policy, which limits lateral movement and post-exploitation impact but does not prevent the initial command execution. Because exploitation is via a single unauthenticated config write plus a getSnap trigger, also review access logs for anomalous setServerConfig requests and unexpected ffmpeg/shell spawns from the service account.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ZLMediaKit is a C++ streaming media server that exposes an HTTP API for management and configuration. The vulnerability is CWE-94 (Improper Control of Generation of Code / Code Injection): the HTTP API module fails to enforce access control on the setServerConfig endpoint, letting an unauthenticated caller write arbitrary values into the server configuration, specifically the ffmpeg.snap parameter used for snapshot/thumbnail generation. That parameter is passed into a shell invocation, so attacker-supplied text becomes an operating-system command. The attacker then triggers the getSnap endpoint, which causes the poisoned configuration to be executed by the ZLMediaKit process. The chain is effectively config-write followed by command execution at the service's privilege level. The issue is pinned to commit 9fd5152; EUVD affected-version data is recorded as "n/a", so other builds must be independently verified for the same unauthenticated config-write-then-execute path. The missing authentication on the management API (PR:N, UI:N in the assessed vector) is the root cause class here rather than a memory-safety defect.
Know when Zlmediakit gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Remote HTTP API reachable without credentials or interaction (AV:N/AC:L/PR:N/UI:N); arbitrary command execution yields full C/I/A within the process's scope (S:U).
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
Incorrect Access Control in the HTTP API module in ZLMediaKit commit 9fd5152 allows remote attackers to achieve Remote Code Execution (RCE) via unauthenticated access to the setServerConfig API endpoint, which permits overwriting the ffmpeg.snap configuration parameter with arbitrary shell commands. These commands are subsequently executed through the getSnap API endpoint with the privileges of the ZLMediaKit process.
Technical POC Analysis
The supplied GHSA evidence identifies CWE-78 (OS Command Injection), not CWE-94.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
ZLMediaKit, an open-source streaming media server, contains a critical access-control flaw that lets anyone who can reach its HTTP management API run commands of their choosing on the host with the service's own privileges - no login or user interaction required. Because these deployments are typically internet-facing and process live video traffic, a successful attack would hand an intruder a foothold inside the network from which to move laterally, tamper with or take down streaming services, and access any data the process can read. Leadership should treat this as an emergency exposure-management issue for any externally reachable or hostile-network-adjacent instance, even though exploitation has not been observed to date.
No vendor-released patch identified at time of analysis. Interim mitigations: block or restrict network access to the ZLMediaKit HTTP API (firewall rules, reverse-proxy ACLs, or binding to localhost/trusted management networks only); place the API behind an authenticating proxy; run the service under a dedicated least-privilege account with restricted filesystem and outbound egress; disable or neutralize the snapshot/ffmpeg.snap configuration path if snapshots are not required; and monitor the host and service for unexpected child-process execution.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Zlmediakit
View allZLMediaKit 4.0 is vulnerable to Directory Traversal. Rated high severity (CVSS 7.5), this vulnerability is remotely expl
Heap buffer overflow in ZLMediaKit's VP9 RTP payload parser allows remote unauthenticated attackers to trigger denial of
An attacker can send malicious RTMP requests to make the ZLMediaKit server crash remotely. Rated high severity (CVSS 7.5
Path traversal in ZLMediaKit's downloadFile API allows an authenticated operator holding the API secret to read files fr
Cross Site Scripting vulnerability in ZLMediaKiet v.4.0 and v.5.0 allows an attacker to execute arbitrary code via a cra
Exploit-DB