OS Command Injection in ZoneMinder - #VU158962
Published: November 3, 2026
Vulnerability details
The vulnerability allows a remote user to execute arbitrary OS commands as the ZoneMinder web server account, potentially accessing database credentials, camera passwords, recorded footage, and web root files.
The vulnerability exists due to improper neutralization of shell metacharacters in ZoneMinder's Event::GenerateVideo() function when constructing an ffmpeg command from event fields. DefaultVideo is interpolated without quoting, while Name receives only whitespace replacement before being embedded in a single-quoted argument. A remote user can use Events=Edit permission on a monitor to set DefaultVideo to x;id>/tmp/zm_rce_poc;echo x or Name to x';id>/tmp/zm_rce_poc2;echo 'x through the API, then trigger event video generation through the web interface to execute arbitrary OS commands as the web server account.