Executive brief
ZoneMinder is open-source video surveillance software used to monitor IP and analog cameras. A vulnerability in version 1.39.17 allows any authenticated user—regardless of their assigned role—to execute arbitrary operating system commands on the server by bypassing permission checks in the filter management feature. An attacker with valid login credentials could compromise the entire surveillance system and the underlying server.
Technical details
The vulnerability exists in the Filter class's canEdit() and canDelete() methods, which invoke non-existent methods on the ZM\User class. Due to PHP's __call() magic method, these calls return a truthy value instead of properly evaluating user permissions, allowing any authenticated user to pass the permission check. The flaw enables filter-based OS command execution regardless of the attacker's assigned role or privileges. The attack requires valid authentication credentials but no additional user interaction. Patches or mitigations should be checked via the vendor's release notes.
Affected products
- ZoneMinder ZoneMinder 1.39.17
Timeline
- 2026-08-11: disclosed