Critical Authenticated OS Command Injection Flaw in ZoneMinder

ZoneMinder, a widely used open-source video surveillance software platform, is affected by an authenticated operating system command injection vulnerability tracked as CVE-2026-76060. According to a CISA advisory (ICSA-26-237-02), the vulnerability exists in the event export functionality where the exportFile HTTP request parameter is not properly sanitized before being passed to PHP's exec() function.

Successful exploitation could allow an authenticated attacker with View Events permission to execute arbitrary operating system commands as the web server user, potentially leading to full system compromise. The CVSS 3.1 base score is 8.8, classified as High, with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

The vulnerability affects ZoneMinder versions 1.37.48 and 1.38.3. CISA reports that a public proof-of-concept was authored by Scriptkittens and reported to the vendor, but no known public exploitation specifically targeting this vulnerability has been reported to CISA at the time of publication.

ZoneMinder has addressed the issue in version 1.38.3 or later. The vendor recommends upgrading to the latest version by downloading the installer from the official ZoneMinder website or obtaining the source code from the project's GitHub repository. Additional details are available in the security advisory GHSA-88m4-hrgp-m9v3, which references CWE-78 (Improper Neutralization of Special Elements used in an OS Command).