OS Command Injection in ZoneMinder - CVE-2026-102607

Vulnerability details

The vulnerability allows a remote user to execute arbitrary operating system commands on the server as the web server user (www-data).

The vulnerability exists due to improper neutralization of shell metacharacters in ZoneMinder's exportEvents() function in web/skins/classic/includes/export_functions.php when processing event export requests. A remote user can submit a request with View Events or View Snapshots permission and a valid __csrf_magic token, injecting shell metacharacters into the exportFile parameter to execute arbitrary operating system commands through PHP's exec().

When using non-existent event IDs, the request must include exportDetail=1 to prevent a PHP fatal error in exportEventImagesMaster().

Affected software

How to mitigate CVE-2026-102607

External References

• https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-7j62-cjxp-3cj5
• https://github.com/ZoneMinder/zoneminder/commit/605f962b7

Related Security Bulletins

• Multiple vulnerabilities in ZoneMinder