Skip to content
OpenAdvisories
High ICSA-26-237-02 1 CVE

Zoneminder

Published Aug 25, 2026 · Updated Aug 25, 2026

Vendor: ZoneMinder Product: zoneminder

Summary

Successful exploitation of this vulnerability could result in full Remote Code Execution (RCE) as the web server user.

Vulnerabilities 1

  • High 8.8
    CVE-2026-76060 Public exploit

    OS Command Injection in PayRange API

    An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HTTP request parameter is passed unsanitized into a shell command executed via PHP's exec(), allowing any authenticated user with View Events…

    ZoneMinder zoneminder zoneminder zoneminder Debian Ubuntu

Revision history

  1. #1

    Initial Publication

References