OS Command Injection in ZoneMinder - CVE-2026-76060
Published: November 3, 2026
Vulnerability details
The vulnerability allows a remote user to execute arbitrary operating system commands as the web server user (www-data).
The vulnerability exists due to improper neutralization of shell metacharacters in web/includes/download_functions.php when constructing event export commands from a monitor's name. A remote user can set a monitor name such as poc'; <command>; echo ' using Monitors=Create or Monitors=Edit permission to execute arbitrary commands when a user with Events=View permission exports an event belonging to that monitor through the web interface or API. The name is incorporated into both the ffmpeg concatenation command and the archive command using single-quote wrapping that does not escape embedded quotes.