Critical severity · published Oct 16, 2026
CVE-2026-102608
ZoneMinder: Authenticated OS Command Injection via unsanitized Monitor Name in event export (download_functions.php)
9.0
CVSS
0.3%
EPSS
No
On KEV
Description
ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, downloadEvents() manually wraps a monitor Name value in single quotes instead of using escapeshellarg() before placing it in shell commands when a user with monitor-create or monitor-edit permission stores a monitor Name containing shell metacharacters and a user with Events View permission exports that monitor's events. In this attack mechanism, the stored monitor Name reaches both the ffmpeg concatenation command and the tar or zip archive command and breaks out of manual quoting. Arbitrary commands execute as the web server user. This issue is fixed in version 1.38.3.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 21% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ZO
zoneminder · ZoneMinder
>= 1.37.48, < 1.38.3 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-102608
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-102608
github.com
https://github.com/ZoneMinder/zoneminder/commit/2de2ae44a1d751bad4b020c5573b2d58c59c1525
github.com
https://github.com/ZoneMinder/zoneminder/commit/b3a7c05f079c87badf4b0ce052da0acfd4047a4b
github.com
https://github.com/ZoneMinder/zoneminder/commit/b5605e01c14354fc8e2dcae8cefd90c3674880d9
github.com
https://github.com/ZoneMinder/zoneminder/releases/tag/1.38.3
github.com
https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-88m4-hrgp-m9v3
www.scriptkittens.com
https://www.scriptkittens.com/blog/two-sinks-one-shell
More from zoneminder
9.9
CVE-2024-51482
Boolean-based SQL Injection in ZoneMinder v1.37.* <= 1.37.64
9.8
CVE-2025-65791
ZoneMinder v1.36.34 is vulnerable to Command Injection in web/views/image.php
9.8
CVE-2024-43360
ZoneMinder Time-based SQL Injection
9.8
CVE-2023-26037
ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras
9.8
CVE-2023-26036
ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras