CVE-2024-58386: ZoneMinder Path Traversal Vulnerability

CVE-2024-58386 Overview

CVE-2024-58386 is a path traversal vulnerability [CWE-22] in ZoneMinder, an open-source video surveillance system. Versions from 1.37.0 up to (but not including) 1.38.0 fail to validate the path parameter in the files view before passing it to output_file. Authenticated users with Events view permission can read arbitrary files on the server, including configuration files that contain database credentials. The flaw resides in web/skins/classic/views/files.php and stems from missing sanitization of user-supplied paths.

Critical Impact
Authenticated attackers with low privileges can read arbitrary files on the ZoneMinder host, exposing database credentials and other sensitive configuration data.

Affected Products

ZoneMinder versions 1.37.0 through 1.37.64
ZoneMinder classic web skin files.php view
Fixed in ZoneMinder release 1.38.0

Discovery Timeline

2026-09-28 - CVE-2024-58386 published to NVD
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2024-58386

Vulnerability Analysis

The vulnerability exists in the files.php view within the ZoneMinder classic web skin. The view reads a user-controlled path request parameter and forwards it to output_file without confirming that the resolved path resides inside a configured storage area. Because the check that a path belonged to a storage area was either missing or bypassable, an authenticated user with Events view permission could request files outside the intended directories.

Exploitation returns file contents to the requester. Attackers commonly target zm.conf and related configuration files to recover MySQL credentials, which then enable database compromise and pivoting deeper into the ZoneMinder deployment.

Root Cause

The root cause is improper input validation on the path parameter. The pre-patch code assigned $_REQUEST['path'] directly to $path and only performed a weak substring check against storage area paths. Traversal sequences such as ../ and stream wrappers like php:// were not stripped, allowing paths to escape the storage boundary.

Attack Vector

An authenticated user with Events view permission sends an HTTP request to the files view specifying a crafted path value. The server reads and returns the requested file. No user interaction beyond an authenticated session is required, and the attack is network-reachable.

php

// Security patch: introduce detaintPathAllowAbsolute and enforce storage-area boundary
// Source: https://github.com/ZoneMinder/zoneminder/commit/3b379e99c0c1e539334ad4186c15ad0dc6c238b9

function detaintPathAllowAbsolute($path) {
  // Strip out :// because php:// is a way to inject code apparently
  $path = str_replace('://', '', $path);
  // Remove any absolute paths, or relative ones that want to go up
  do {
    $path = str_replace('../', '', $path, $count);
  } while($count);
  return $path;
}

// In web/skins/classic/views/files.php
$path = (!empty($_REQUEST['path']))
  ? detaintPathAllowAbsolute($_REQUEST['path'])
  : ZM_DIR_EVENTS;

php

// Follow-up hardening: only output file if the path is under a storage area
// Source: https://github.com/ZoneMinder/zoneminder/commit/071d968bc8ecd5c4f56a87cbe0c3063bc35dbc5d

$is_ok_path = false;
if ($path) {
  foreach ($storage_areas as $storage) {
    $rc = strstr($path, $storage->Path(), true);
    if ((false !== $rc) and ($rc == '')) {
      # Must be at the beginning
      $is_ok_path = true;
      break;
    }
  }
  if ($is_ok_path) {
    $path_parts = pathinfo($path);
    // ... proceed to output the file
  }
}

Detection Methods for CVE-2024-58386

Indicators of Compromise

HTTP requests to web/skins/classic/views/files.php containing path parameter values with ../ sequences or absolute paths outside configured storage areas.
Requests including stream wrapper prefixes such as php://, file://, or data:// in the path parameter.
Web server access logs showing successful reads of files such as zm.conf, /etc/passwd, or files under /etc/zm/ by low-privileged accounts.

Detection Strategies

Inspect ZoneMinder web logs for files.php requests where the path argument resolves outside configured storage paths.
Correlate authenticated session activity with anomalous file-view requests originating from Events-view-only accounts.
Alert on repeated files.php requests from a single user within short time windows, which suggests enumeration of sensitive files.

Monitoring Recommendations

Enable and centralize Apache or Nginx access logs for the ZoneMinder web root and forward them to a SIEM or data lake for retention and query.
Monitor file access on the ZoneMinder host for reads of configuration files by the web server user outside expected application flows.
Track the ZoneMinder version in use across your fleet and flag any host still running a 1.37.x build.

How to Mitigate CVE-2024-58386

Immediate Actions Required

Upgrade ZoneMinder to release 1.38.0 or later, which contains commits 071d968 and 3b379e9.
Rotate any credentials that may have been exposed through the vulnerable files view, including MySQL passwords stored in zm.conf.
Audit ZoneMinder user accounts and remove Events view permission from users who do not require it.

Patch Information

The fix is delivered in ZoneMinder 1.38.0. It introduces the detaintPathAllowAbsolute helper in web/includes/functions.php to strip :// and ../ sequences, and it enforces that the requested path in web/skins/classic/views/files.php must start with a configured storage area path before the file is served. See the GitHub Security Advisory GHSA-8fw2-wh82-vv4h and the VulnCheck advisory for additional details.

Workarounds

Restrict network access to the ZoneMinder web interface using firewall rules or a reverse proxy, limiting reachability to trusted operator networks.
Place a web application firewall or reverse proxy rule in front of files.php that rejects requests where the path parameter contains ../, ://, or absolute paths outside expected storage roots.
Reduce the blast radius by ensuring the ZoneMinder process user has read access only to storage directories and required configuration files.

bash

# Example Nginx rule to block traversal sequences in the path parameter
location ~* /skins/classic/views/files\.php$ {
    if ($arg_path ~* "(\.\./|://|^/)") {
        return 403;
    }
    proxy_pass http://zoneminder_backend;
}