CISA Flags ZoneMinder OS Command Injection
Any authenticated user with View Events permission can execute arbitrary commands on the server; upgrading to version 1.38.3 or later closes the vector.
TL;DR
CISA published advisory ICSA-26-237-02 for CVE-2026-76060, an authenticated OS command injection vulnerability in ZoneMinder versions 1.37.48 and 1.38.3. The flaw in the event export function passes unsanitized user input to PHP's exec(), letting any authenticated user with View Events permission achieve remote code execution. ZoneMinder has released a fix in version 1.38.3. No known active exploitation has been reported to CISA.
The vulnerability sits in ZoneMinder's event export functionality. When an authenticated user triggers an event export, the exportFile HTTP request parameter flows unsanitized into a shell command executed via PHP's exec(). The flaw doesn't require elevated privileges; any user with View Events permission can exploit it to run arbitrary OS commands as the web server user. CVSS 3.1 scores the vulnerability at 8.8 (HIGH); CVSS 4.0 puts it at 8.7.
CISA discovered a public proof of concept authored by "Scriptkittens" and reported it to ZoneMinder. The fix is straightforward: upgrade to version 1.38.3 or later. ZoneMinder, an open-source CCTV application deployed worldwide across Linux systems, has seen a steady stream of command injection and SQL injection vulnerabilities in recent years: CVE-2023-26035 (unauthenticated RCE), CVE-2023-26039 (authenticated OS command injection), and CVE-2026-27470 (second-order SQL injection) all precede this advisory. Organizations running ZoneMinder in environments subject to CMMC, FedRAMP, or CJIS controls should verify the patch is applied and confirm that the web server user isn't over-privileged. CISA hasn't received reports of active exploitation targeting this specific vulnerability at the time of publication.
Published ·Deep Fathom