OS Command Injection in ZoneMinder - #VU158955
Published: November 3, 2026
Vulnerability identifier: #VU158955
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-78
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary OS commands as the ZoneMinder runtime user.
The vulnerability exists due to improper neutralization of OS commands and insufficient authorization in the ZoneMinder filter execution flow when processing temporary event filters. A remote attacker can use an Events=View account, or chain exploitation with a JWT/session authentication bypass or a default JWT secret, to submit a temporary filter with AutoExecute=1 and an attacker-controlled AutoExecuteCmd to execute arbitrary OS commands through zmfilter.pl.
The demonstrated exploit requires at least one existing event with Executed=0.
Affected software
ZoneMinder
Remediation
Install security update from vendor's website.