Executive brief
ZoneMinder is an open-source video surveillance software that records and manages camera feeds. An authenticated attacker with permission to create monitors and view events can inject operating system commands through a monitor's name field, achieving full remote code execution on the server running ZoneMinder. This allows an attacker to compromise the entire surveillance system and potentially access sensitive video recordings and system data.
Technical details
The vulnerability is an OS command injection (CWE-78) in ZoneMinder's event export functionality (download_functions.php). The Monitor Name field is interpolated directly into shell commands passed to PHP's exec() without proper sanitization; attackers use manual single-quote wrapping instead of escapeshellarg(), which allows breakout via embedded single quotes (e.g., `poc'; <command>; echo '`). Attack preconditions: an attacker with Monitors=Create or Monitors=Edit permissions sets a malicious monitor name, then any authenticated user with Events=View permission who exports events from that monitor triggers the injected command. The payload executes as the web server user (www-data). Affected versions: 1.37.48 to 1.38.2 inclusive. Patched in 1.38.3 by replacing manual quoting with escapeshellarg() and adding -- end-of-options markers in tar/zip/gzip commands.
Affected products
- ZoneMinder ZoneMinder >1.37.48, <1.38.3
Timeline
- 2026-07-22: disclosed
- 2026-07-22: patched: Version 1.38.3 and later; commits b3a7c05f0 and 2de2ae44a
- 2026-08-28: advisory