SB2026060474 - Multiple vulnerabilities in ZoneMinder

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026060474

SB2026060474 - Multiple vulnerabilities in ZoneMinder

Published: June 4, 2026 Updated: November 3, 2026

Security Bulletin ID SB2026060474
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 16
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 6% Medium 25% Low 69%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 16 vulnerabilities.


1) Authorization bypass through user-controlled key (CVE-ID: CVE-2026-54258)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to the cross-monitor event media authorization bypass in direct event media endpoints. A remote user can retrieve private event media on the system.


2) Incorrect authorization (CVE-ID: CVE-2026-102297)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose frame metadata for monitors they are not authorized to access.

The vulnerability exists due to incorrect authorization in ZoneMinder's FramesController::index() when handling frame-listing requests: the computed per-monitor restriction is not applied to the database query. A remote user can use an account with Events permission set to View to request /zm/api/frames.json or target a denied monitor through /zm/api/frames/index.json/MonitorId:5 to retrieve its frame records, including event and monitor identifiers, timestamps, motion scores, and frame types.

The disclosure does not include JPEG images; access to the actual media remains subject to authorization checks on the owning event.


3) Server-Side Request Forgery (SSRF) (CVE-ID: N/A)

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:N/SA:N]


The vulnerability allows a remote user to probe internal services and trigger state-changing GET endpoints through server-side requests to arbitrary internal or external hosts.

The vulnerability exists due to insufficient validation of destination URLs in the ZoneMinder image view route when processing the proxy parameter. A remote user can supply an arbitrary HTTP or HTTPS URL that passes a scheme-only check and is fetched using fopen() to probe internal services or trigger unauthorized actions through reachable GET endpoints.

Response handling is image-oriented, so successful exploitation does not necessarily expose the complete response from the target service.


4) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to modify the retention-protection state of arbitrary recorded events, including events belonging to monitors outside their authorized scope.

The vulnerability exists due to missing authorization checks in ZoneMinder's EventsController::archive() action when handling event archive requests. A remote user can send GET requests to /zm/api/events/archive/<id>.json with chosen numeric event identifiers using read-only Events = View permission to toggle the Archived flag without Events = Edit permission or per-monitor authorization, making preserved recordings eligible for automatic deletion or protecting arbitrary recordings from automatic purging.


5) Server-Side Request Forgery (SSRF) (CVE-ID: N/A)

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:L/SI:N/SA:N]


The vulnerability allows a remote user to probe internal HTTP services, disclose internal image content, and cause a denial of service.

The vulnerability exists due to insufficient validation of destination URLs in ZoneMinder's web/views/image.php image proxy when processing the proxy query parameter. A remote user can submit specially crafted HTTP or HTTPS URLs to induce server-side requests to internal services, enumerate hosts and ports through response differences, retrieve image-format responses, and exhaust PHP-FPM workers or internal service rate limits.


6) Cross-site scripting (CVE-ID: N/A)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote user to execute arbitrary JavaScript in another user's browser in the context of ZoneMinder, potentially accessing sensitive information or performing actions with the victim's permissions.

The vulnerability exists due to improper output escaping in the Zone.Name HTML and SVG rendering paths when displaying stored zone names. A remote user can save a zone name containing a <script> payload with zone-edit permission to execute JavaScript when another user, including an administrator, views the affected zone, plugin, event, montage, or stream page.


7) Cross-site scripting (CVE-ID: N/A)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote user to execute arbitrary JavaScript in another user's browser in the context of ZoneMinder, potentially accessing sensitive information or performing actions with the victim's permissions.

The vulnerability exists due to improper output escaping in web/skins/classic/views/js/event.js.php when embedding stored event names and notes into inline JavaScript strings. A remote user can save crafted Event.Name or Event.Notes values with event-edit permission, using a </script> breakout or JavaScript string delimiters to execute JavaScript when another user, including an administrator, views the affected event page.


8) Cross-site scripting (CVE-ID: N/A)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote user to execute arbitrary JavaScript in another user's browser in the context of ZoneMinder, potentially accessing sensitive information or performing actions with the victim's permissions.

The vulnerability exists due to improper output escaping in web/ajax/modals/server.php when displaying stored server names in modal titles. A remote user can save a server name containing a <script> payload with server-edit permission to execute JavaScript when another user, including an administrator, views the affected server modal.


9) SQL injection (CVE-ID: N/A)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive database information and delay database queries.

The vulnerability exists due to improper neutralization of SQL expressions in the event filter sort_field handling when loading a report linked to a saved filter. A remote user can save a crafted sort_field value, such as SLEEP(5), that passes through strip_tags() and is later concatenated directly into an SQL ORDER BY clause to extract sensitive database information through blind SQL injection or delay query execution.


10) Command injection (CVE-ID: CVE-2026-28273)

CWE-ID: CWE-77 - Command injection

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary commands with the privileges of the web server user, exposing private camera feeds, recorded events, and database data.

The vulnerability exists due to command injection and missing authorization checks in the ZoneMinder configuration API when modifying configuration values that are subsequently used in exec() calls. A remote user can modify ZM_PATH_FFMPEG through /api/configs/edit/ZM_PATH_FFMPEG.json to contain /usr/bin/ffmpeg ; echo '<?php system($_GET["cmd"]); ?>' > /var/cache/zoneminder/cache/shell.php ; # and request an image view with an event ID and frame ID to execute arbitrary commands and create a web shell.


11) Path Traversal: \'.../...//\' (CVE-ID: CVE-2024-58386)

CWE-ID: CWE-35 - Path Traversal: \'.../...//\'

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to potentially cause a denial of service.

The vulnerability exists due to improper restriction of directory traversal in ZoneMinder's web/skins/classic/views/files.php when processing user-supplied path parameters. A remote user can submit a specially crafted path containing ../ or encoded traversal sequences to reach files outside the permitted directory and potentially disrupt service availability.


12) Buffer overflow (CVE-ID: CVE-2026-102296)

CWE-ID: CWE-120 - Buffer overflow

CVSSv4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to corrupt memory, potentially compromising sensitive information and data integrity.

The vulnerability exists due to unchecked buffer copies in the non-PCRE HTTP response parser in RemoteCameraHTTP::GetResponse() when processing camera response headers. A remote attacker can supply oversized HTTP status messages or header values through a malicious configured camera or interception of camera traffic to overflow fixed-size static buffers and corrupt adjacent parser state, potentially compromising sensitive information and data integrity.

The affected parser is used by default when ZoneMinder is built without PCRE support.


13) Stack-based buffer overflow (CVE-ID: N/A)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code on the ZoneMinder server.

The vulnerability exists due to a stack-based buffer overflow in SessionDescriptor::generateFormatContext() in src/zm_sdp.cpp when parsing an SDP response during RTSP DESCRIBE processing. A remote attacker can supply an oversized sprop-parameter-sets value through a malicious configured RTSP camera or a man-in-the-middle attack on the camera network, causing strcpy() to copy the value into a 1024-byte stack buffer without bounds checking and overwrite the saved frame pointer and return address to execute arbitrary code.


14) Authorization bypass through user-controlled key (CVE-ID: N/A)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to read event data belonging to cameras the account is not authorized to access.

The vulnerability exists due to missing per-monitor authorization checks in ZoneMinder's EventDataController when handling event data read requests. A remote user can use an account with global events-viewing permission to request data through index() or view($id) to disclose event data from monitors outside the account's permitted scope.


15) SQL injection (CVE-ID: N/A)

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive database information and escalate privileges through account takeover.

The vulnerability exists due to SQL injection in ZoneMinder's filterdebug.php and Filter::Events() when constructing SQL queries using an unvalidated filter limit value. A remote user can submit a crafted filter[Query][limit] parameter or supply a malicious stored filter to inject SQL, extract password hashes and token-related data, and facilitate administrator account takeover.


16) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to view the database query plan of another user's filter without authorization.

The vulnerability exists due to missing effective per-filter authorization in ZoneMinder's filterdebug modal when handling requests to inspect filters. A remote user can request debugging information for another user's filter to disclose its SQL query plan.


Remediation

Install update from vendor's website.

References