CVE-2026-102607: ZoneMinder RCE Vulnerability

CVE-2026-102607 Overview

CVE-2026-102607 is an OS command injection vulnerability [CWE-78] in ZoneMinder, a free, open source closed-circuit television (CCTV) software application. The flaw resides in the exportEvents() function, which concatenates the attacker-controlled exportFile request parameter into a shell command without neutralizing shell metacharacters. An authenticated user with View Events or View Snapshots permission can submit a crafted event export request and execute arbitrary operating system commands as the web server user. The issue affects versions prior to 1.38.3 and is fixed in version 1.38.3.

Critical Impact
Authenticated attackers can achieve remote code execution on the ZoneMinder host, compromising CCTV footage, pivoting into surveillance networks, and gaining a foothold as the web server user.

Affected Products

ZoneMinder versions prior to 1.38.3
web/ajax/event.php component
web/skins/classic/includes/export_functions.php component

Discovery Timeline

2026-10-16 - CVE-2026-102607 published to NVD
2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-102607

Vulnerability Analysis

The vulnerability is a classic OS command injection flaw in the event export workflow. When an authenticated user submits an event export request with exportDetail enabled and a valid Cross-Site Request Forgery (CSRF) token, the exportEvents() function in web/skins/classic/includes/export_functions.php passes the exportFile parameter directly into a shell command. The parameter reaches the trailing directory argument of a tar or zip command invoked through PHP's exec() function. Because shell metacharacters are not neutralized, an attacker can break out of the intended argument context and append arbitrary commands. Execution occurs under the web server account, giving the attacker read and write access to the ZoneMinder installation, recorded video archives, and any resources the web server can reach on the host or local network.

Root Cause

The root cause is missing input sanitization on user-supplied values that flow into shell command construction. The pre-patch code built tar or zip invocations by concatenating the raw exportFile and connkey values. Neither parameter was filtered against a safe character allowlist nor escaped using escapeshellarg() before reaching exec().

Attack Vector

Exploitation requires network access to the ZoneMinder web interface, valid credentials with View Events or View Snapshots permission, and a valid CSRF token. The attacker crafts an export request containing shell metacharacters in the exportFile parameter with exportDetail enabled. When the server processes the request, the injected commands execute in the context of the web server user.

php

     return false;
   }
 
+  // Sanitize user-supplied values used in file paths and shell commands
+  $export_root = preg_replace('/[^\w\-.]/', '', $export_root);
+  if (empty($export_root)) $export_root = 'zmExport';
+  $connkey = preg_replace('/[^\w\-.]/', '', $connkey);
+
   if (!($exportFormat == 'tar' or $exportFormat == 'zip')) {
     ZM\Error("None or invalid exportFormat specified $exportFormat.");
     return false;

Source: GitHub Commit 548ed87. The patch applies a strict allowlist regex ([^\w\-.]) that strips any character outside word characters, hyphens, and periods, preventing shell metacharacters from reaching exec().

Detection Methods for CVE-2026-102607

Indicators of Compromise

HTTP POST requests to web/ajax/event.php containing shell metacharacters (;, |, `, $(), &&) in the exportFile parameter.
Unexpected child processes of the web server (www-data, apache, nginx) spawning shells such as /bin/sh, /bin/bash, or network utilities like curl, wget, or nc.
New files or scheduled tasks created under the ZoneMinder export directory outside normal export archive naming conventions.

Detection Strategies

Inspect web server access logs for POST requests to the event export endpoint with suspicious characters URL-encoded in exportFile.
Monitor process ancestry for tar or zip processes whose command line contains injected operators or whose parent is the PHP interpreter.
Correlate authentication events for low-privilege ZoneMinder accounts with subsequent command execution telemetry on the host.

Monitoring Recommendations

Enable PHP request logging and forward it alongside endpoint process telemetry to a central analytics tier for correlation.
Alert on any outbound network connections initiated by the ZoneMinder web server process to non-approved destinations.
Baseline normal export activity and flag deviations in frequency, source account, or payload length.

How to Mitigate CVE-2026-102607

Immediate Actions Required

Upgrade ZoneMinder to version 1.38.3 or later, which applies allowlist sanitization to exportFile and connkey.
Restrict the ZoneMinder web interface to trusted networks and enforce multi-factor authentication for all accounts.
Audit existing user accounts and revoke View Events or View Snapshots permission from accounts that do not require it.

Patch Information

The fix is included in the GitHub Release 1.38.3. Technical details and remediation guidance are documented in GitHub Security Advisory GHSA-7j62-cjxp-3cj5. The relevant source changes are in GitHub Commit 548ed87 and GitHub Commit 605f962.

Workarounds

If immediate patching is not possible, disable the event export feature or block access to web/ajax/event.php at the reverse proxy layer.
Deploy a web application firewall rule to reject requests to the export endpoint where exportFile contains characters outside [A-Za-z0-9._-].
Run the web server under a least-privileged account and restrict its filesystem and network reach using systemd confinement or AppArmor profiles.

bash

# Example nginx rule to block suspicious exportFile values at the proxy
location = /zm/web/ajax/event.php {
    if ($arg_exportFile ~* "[^A-Za-z0-9._-]") {
        return 403;
    }
    proxy_pass http://zoneminder_backend;
}