CVE-2026-67827 Overview
CVE-2026-67827 is an unauthenticated remote code execution vulnerability in the ZLMediaKit HTTP API module at commit 9fd5152. Remote attackers can reach the setServerConfig API endpoint without authentication and overwrite the ffmpeg.snap configuration parameter with arbitrary shell commands. Those commands are then executed when the attacker calls the getSnap API endpoint, running with the privileges of the ZLMediaKit process. The flaw is classified under CWE-94: Improper Control of Generation of Code.
Critical Impact
Unauthenticated attackers can achieve full remote code execution on any exposed ZLMediaKit instance running the affected commit, leading to complete media server compromise.
Affected Products
- ZLMediaKit media streaming server at commit 9fd5152
- Deployments exposing the HTTP API module without network restrictions
- Instances relying on default configuration for the setServerConfig endpoint
Discovery Timeline
- 2026-09-21 - CVE-2026-67827 published to the National Vulnerability Database (NVD)
- 2026-09-24 - Last updated in NVD database
Technical Details for CVE-2026-67827
Vulnerability Analysis
ZLMediaKit exposes an HTTP API for runtime configuration and media operations. The setServerConfig endpoint accepts configuration key-value pairs, including the ffmpeg.snap parameter that defines the shell command template used to generate media snapshots. The endpoint lacks authentication and authorization checks, so any network-reachable client can rewrite server configuration values.
The getSnap endpoint later invokes the configured ffmpeg.snap command through a shell to produce a snapshot. Because the attacker controls the command string, the shell executes arbitrary attacker-supplied commands under the ZLMediaKit process account. This turns a configuration write primitive into a reliable code execution primitive.
Root Cause
The root cause is Incorrect Access Control combined with unsafe code generation ([CWE-94]). The HTTP API module treats configuration mutation as a public operation and passes the stored ffmpeg.snap value to a shell interpreter without sanitization or command allow-listing. No authentication token, session cookie, or IP restriction gates the setServerConfig endpoint.
Attack Vector
Exploitation requires only network reachability to the ZLMediaKit HTTP API port. An attacker sends a single HTTP request to setServerConfig to overwrite ffmpeg.snap with a malicious command sequence. A follow-up request to getSnap triggers execution. Because both steps are unauthenticated, the attack works remotely with low complexity.
See the GitHub Security Advisory GHSA-qh3r-f727-ww9m for full technical details.
Stop Remote Code Execution Before It Runs
Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.
Stop Exploit AttemptsDetection Methods for CVE-2026-67827
Indicators of Compromise
- HTTP POST or GET requests to /index/api/setServerConfig containing an ffmpeg.snap parameter with shell metacharacters such as ;, &&, |, or backticks
- Subsequent requests to /index/api/getSnap from the same or related source IP
- ZLMediaKit process spawning unexpected child processes such as sh, bash, curl, wget, or nc
- Outbound network connections from the ZLMediaKit host to previously unseen IP addresses shortly after API activity
Detection Strategies
- Alert on any unauthenticated access to setServerConfig from non-management network segments
- Inspect HTTP request bodies for configuration keys embedding shell operators or command binaries
- Correlate setServerConfig writes with getSnap reads occurring within a short time window from the same source
- Baseline expected child processes of the ZLMediaKit binary and flag deviations
Monitoring Recommendations
- Forward ZLMediaKit access logs and host process telemetry to a centralized analytics pipeline
- Monitor for new listening sockets or reverse shells originating from the media server host
- Track configuration file changes and API-driven configuration mutations with file integrity monitoring
How to Mitigate CVE-2026-67827
Immediate Actions Required
- Remove ZLMediaKit HTTP API endpoints from public network exposure using firewall or reverse proxy rules
- Enforce authentication on the HTTP API by configuring a strong api.secret value and requiring it on every request
- Audit ffmpeg.snap and related configuration values for unexpected shell commands and reset them to safe defaults
- Review process execution history on affected hosts for signs of prior exploitation
Patch Information
No fixed release version is listed in the NVD entry at time of publication. Track the upstream GitHub Security Advisory GHSA-qh3r-f727-ww9m for patched commits and apply updates once available. Rebuild deployments from a post-fix commit rather than the vulnerable 9fd5152 commit.
Workarounds
- Bind the HTTP API listener to 127.0.0.1 and require access through an authenticated reverse proxy
- Restrict setServerConfig access with network ACLs limiting it to trusted management hosts only
- Run the ZLMediaKit process under a dedicated low-privilege account with no shell and restricted filesystem access
- Disable snapshot functionality if getSnap is not required by the deployment
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
