Description
An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HTTP request parameter is passed unsanitized into a shell command executed via PHP's exec(), allowing any authenticated user with View Events permission to execute arbitrary operating system commands on the server.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Zoneminder | Zoneminder | 1.37.48 – < 1.38.3 | 1.38.3 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | zoneminder | No fix yet | — |
| Debian 13 | zoneminder | No fix yet | — |
| Debian 12 | zoneminder | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | zoneminder | No fix yet | — |
| Ubuntu 26.04 LTS | zoneminder | No fix yet | — |
| Ubuntu 24.04 LTS | zoneminder | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 22.04 LTS | zoneminder | No fix yet | — |
| Ubuntu Pro 20.04 LTS | zoneminder | No fix yet | — |
| Ubuntu Pro 16.04 LTS | zoneminder | No fix yet | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
investigato/CVE-2026-76060_ZoneMinder_CommandInjection-PoC ★ 1 · Jun 6, 2026
CVE-2026-76060 PoC for a ZoneMinder vulnerability leading to RCE
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 1
- ICSA-26-237-02 Zoneminder CISA ICS & IT advisories · Aug 25, 2026
References
- https://zoneminder.com/downloads
- https://github.com/ZoneMinder/zoneminder
- https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-88m4-hrgp-m9v3
- https://www.cisa.gov/news-events/ics-advisories/icsa-26-237-02
- https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-237-02.json