Description
ZoneMinder versions 1.37.0 before 1.38.0 contain a path traversal vulnerability in the files view that allows authenticated users to read arbitrary files. The path parameter is not properly validated before being passed to output_file, enabling attackers with Events view permission to access sensitive files like configuration files containing database credentials.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| ZoneMinder | zoneminder | 1.37.0 – < 1.38.0 | 1.38.0 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | zoneminder | No fix yet | — |
| Debian 13 | zoneminder | No fix yet | — |
| Debian 12 | zoneminder | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | zoneminder | No fix yet | — |
| Ubuntu 26.04 LTS | zoneminder | No fix yet | — |
| Ubuntu 24.04 LTS | zoneminder | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 22.04 LTS | zoneminder | No fix yet | — |
| Ubuntu Pro 20.04 LTS | zoneminder | No fix yet | — |
| Ubuntu Pro 16.04 LTS | zoneminder | No fix yet | — |
References
- Patch Commit patch
- https://github.com/ZoneMinder/zoneminder product
- GitHub Security Advisory (GHSA-8fw2-wh82-vv4h) vendor-advisory
- https://github.com/ZoneMinder/zoneminder/commit/071d968bc8ecd5c4f56a87cbe0c3063bc35dbc5d patch
- https://github.com/ZoneMinder/zoneminder/issues/4472 issue-tracking
- zoneminder 1.38.0 Release Notes release-notes
- https://github.com/ZoneMinder/zoneminder/blob/1.37.64/web/skins/classic/views/files.php#L26-L39 technical-description
- VulnCheck Advisory: ZoneMinder 1.37.x Path Traversal via files view third-party-advisory