Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.0
CVE-2026-102608: ZoneMinder allows attackers to run commands via crafted monitor name
CVE-2026-102608 · published 25 days ago
Summary
If you use ZoneMinder version older than 1.38.3, a user who can create or edit camera names can embed special characters in the name. When another user later downloads event recordings, those characters break the system’s command line and let the attacker run any code the web server can run. Update ZoneMinder to version 1.38.3 or later to stop this risk.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | zoneminder | zoneminder | >= 1.37.48, < 1.38.3 |
| Ubuntu:Pro:16.04:LTS | canonical | zoneminder | All versions |
Original advisory text
ZoneMinder: Authenticated OS Command Injection via unsanitized Monitor Name in event export (download_functions.php)
ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, downloadEvents() manually wraps a monitor Name value in single quotes instead of using escapeshellarg() before placing it in shell commands when a user with monitor-create or monitor-edit permission stores a monitor Name containing shell metacharacters and a user with Events View permission exports that monitor's events. In this attack mechanism, the stored monitor Name reaches both the ffmpeg concatenation command and the tar or zip archive command and breaks out of manual quoting. Arbitrary commands execute as the web server user. This issue is fixed in version 1.38.3.
References
- https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-88m4-hrgp-m9v3 Third Party Advisory
- https://github.com/ZoneMinder/zoneminder/commit/2de2ae44a1d751bad4b020c5573b2d58...
- https://github.com/ZoneMinder/zoneminder/commit/b3a7c05f079c87badf4b0ce052da0acf...
- https://github.com/ZoneMinder/zoneminder/commit/b5605e01c14354fc8e2dcae8cefd90c3...
- https://github.com/ZoneMinder/zoneminder/releases/tag/1.38.3
- https://www.scriptkittens.com/blog/two-sinks-one-shell
- https://ubuntu.com/security/CVE-2026-102608 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-102608 Third Party Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-78OS Command Injection
Timeline
Published16 Oct 2026
Updated3 Nov 2026
First seen16 Oct 2026
Track software like this
Free during beta