OS Command Injection in ZoneMinder - #VU158950
Published: November 3, 2026
Vulnerability details
The vulnerability allows a remote user to execute arbitrary operating system commands as the web server user on the ZoneMinder server.
The vulnerability exists due to improper neutralization of shell metacharacters in the wget() helper in web/includes/monitor_probe.php when processing camera discovery URLs containing user-supplied credentials. A remote user can submit a camera username such as a;touch /tmp/zm_probe_marker;# or a password containing shell metacharacters through the camera discovery request to inject commands into the URL passed to exec() and execute arbitrary operating system commands as the web server user.
Exploitation requires Monitors Create or Edit privileges and a deployment where camera discovery reaches a wget()-based vendor helper such as Hikvision, Avigilon, or Vivotek.