Is CVE-2026-102607 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-102607 being exploited in the wild.

How severe is CVE-2026-102607?

High severity, with a CVSS score of 8.8, published 16 October 2026.

How is CVE-2026-102607 attacked?

It is attacked over the network.

Am I affected by CVE-2026-102607?

Check whether you run Zoneminder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-102607: ZoneMinder command injection in event export

CVE-2026-102607 · Severity: high · CVSS 8.8 · Published 2026-10-16

ZoneMinder is open-source CCTV surveillance software. An authenticated attacker with permission to view events can inject arbitrary shell commands through a crafted export file parameter, gaining code execution as the web server user. This allows the attacker to compromise the entire system running ZoneMinder.

Technologies: Zoneminder. Vendors: Zoneminder.

Quick answers

Is CVE-2026-102607 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-102607 being exploited in the wild.
How severe is CVE-2026-102607?: High severity, with a CVSS score of 8.8, published 16 October 2026.
Which products and versions are affected?: Zoneminder before 1.38.3.
Is there a fix for CVE-2026-102607?: Yes: fixed in 1.38.3. Until then: Restrict access to event export functionality to trusted users only; disable event export if not actively used. Apply input validation filtering on the exportFile parameter to allow only safe characters (alphanumerics, hyphens, periods). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-102607 attacked?: It is attacked over the network.
Am I affected by CVE-2026-102607?: Check whether you run Zoneminder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 1.38.3

Restrict access to event export functionality to trusted users only; disable event export if not actively used. Apply input validation filtering on the exportFile parameter to allow only safe characters (alphanumerics, hyphens, periods).

Technical details

The exportEvents() function in web/skins/classic/includes/export_functions.php concatenates the user-supplied exportFile POST parameter directly into shell commands executed via exec() without sanitizing shell metacharacters. An authenticated user with View Events or View Snapshots permissions can inject OS commands through the exportFile parameter when submitting an event export request with a valid CSRF token. The injected command reaches the tar/zip archive path argument and executes with web server privileges.

Affected products

ZoneMinder ZoneMinder before 1.38.3

Timeline

2026-10-16: disclosed
2026-10-16: patched: Fixed in version 1.38.3

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.