Quick answers
- Is CVE-2026-76060 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-76060 being exploited in the wild.
- How severe is CVE-2026-76060?
- High severity, with a CVSS score of 8.8, published 28 August 2026.
- Which products and versions are affected?
- Zoneminder >1.37.48, <1.38.3.
- Is there a fix for CVE-2026-76060?
- A patch was published on 2026-07-22: Version 1.38.3 and later; commits b3a7c05f0 and 2de2ae44a Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-76060 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-76060?
- Check whether you run Zoneminder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is an OS command injection (CWE-78) in ZoneMinder's event export functionality (download_functions.php). The Monitor Name field is interpolated directly into shell commands passed to PHP's exec() without proper sanitization; attackers use manual single-quote wrapping instead of escapeshellarg(), which allows breakout via embedded single quotes (e.g., `poc'; <command>; echo '`). Attack preconditions: an attacker with Monitors=Create or Monitors=Edit permissions sets a malicious monitor name, then any authenticated user with Events=View permission who exports events from that monitor triggers the injected command. The payload executes as the web server user (www-data). Affected versions: 1.37.48 to 1.38.2 inclusive. Patched in 1.38.3 by replacing manual quoting with escapeshellarg() and adding -- end-of-options markers in tar/zip/gzip commands.
Affected products
- ZoneMinder ZoneMinder >1.37.48, <1.38.3
Timeline
- 2026-07-22: disclosed
- 2026-07-22: patched: Version 1.38.3 and later; commits b3a7c05f0 and 2de2ae44a
- 2026-08-28: advisory