PHP file inclusion in ZoneMinder - CVE-2023-26038
Published: February 24, 2023 / Updated: November 3, 2026
Vulnerability identifier: #VU158926
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-26038
CWE-ID: CWE-98
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose sensitive information and make unauthorized changes to application data.
The vulnerability exists due to improper control of local file inclusion in web/ajax/modal.php when handling requests. A remote user can supply crafted input to cause unintended local files to be included, potentially disclosing sensitive information or enabling unauthorized changes to application data.
Affected software
ZoneMinder
How to mitigate CVE-2023-26038
Install security update from vendor's website.
ZoneMinder - addressed in versions 1.36.33, 1.37.33