Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-102608— ZoneMinder: Authenticated OS Command Injection via unsanitized Monitor Name in event export (download_functions.php)

Quick assessment

Affected
ZoneMinder zoneminder
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

ZoneMinder 是一款免费、开源的闭路电视（CCTV）软件应用。在 1.38.3 版本之前，当拥有“创建监视器”或“编辑监视器”权限的用户保存了一个包含 Shell 元字符的监视器名称，随后拥有“事件查看”权限的用户导出该监视器的事件时，downloadEvents() 函数在将监视器名称放入 Shell 命令之前，会手动使用单引号包裹该名称，而非使用 escapeshellarg() 函数进行转义。在此攻击机制中，被存储的监视器名称会同时传入 ffmpeg 拼接命令以及 tar 或 zip 归档命令，从而突

CVSS 9.0 · Critical

Affected Version Matrix 1

VendorProduct Version RangeStatus
ZoneMinder zoneminder >= 1.37.48, < 1.38.3 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-102608

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
ZoneMinder: Authenticated OS Command Injection via unsanitized Monitor Name in event export (download_functions.php)
Source: CVE Program / CVE List V5
Vulnerability Description
ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, downloadEvents() manually wraps a monitor Name value in single quotes instead of using escapeshellarg() before placing it in shell commands when a user with monitor-create or monitor-edit permission stores a monitor Name containing shell metacharacters and a user with Events View permission exports that monitor's events. In this attack mechanism, the stored monitor Name reaches both the ffmpeg concatenation command and the tar or zip archive command and breaks out of manual quoting. Arbitrary commands execute as the web server user. This issue is fixed in version 1.38.3.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
OS命令中使用的特殊元素转义处理不恰当(OS命令注入)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
ZoneMinder zoneminder >= 1.37.48, < 1.38.3 -

II. Public POCs for CVE-2026-102608

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-102608

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-102608 (3)

Vendor Advisories for CVE-2026-102608 (1)

Security Blog Posts for CVE-2026-102608 (1)

Vendor Pages for CVE-2026-102608 (1)

Same Patch Batch · ZoneMinder · 2026-10-16 · 3 CVEs total

CVE-2026-102607 8.8 HIGH ZoneMinder: Authenticated OS Command Injection (RCE) via Export Feature
CVE-2026-30971 8.8 HIGH ZoneMinder: Authenticated RCE via command injection in monitor Device Path

IV. Related Vulnerabilities

Same product: zoneminder
Same vendor: ZoneMinder
Same weakness: CWE-78

V. Comments for CVE-2026-102608

No comments yet

Leave a comment