CVE-2026-72556: ZoneMinder RCE Vulnerability

CVE-2026-72556 Overview

CVE-2026-72556 is a remote code execution vulnerability in ZoneMinder 1.39.17, an open-source video surveillance platform. The flaw resides in the Filter class, where the canEdit() and canDelete() methods invoke nonexistent methods on the ZM\User class. PHP's __call() magic method returns a truthy value for these missing methods, bypassing the intended permission check. Any authenticated user, regardless of assigned role, can trigger filter-based operating system command execution. The vulnerability is categorized under [CWE-78] (OS Command Injection).

Critical Impact
Any authenticated ZoneMinder user can execute arbitrary operating system commands on the underlying host, leading to full compromise of the surveillance server.

Affected Products

ZoneMinder 1.39.17
ZoneMinder video surveillance platform (Filter subsystem)
Deployments exposing ZoneMinder web UI to authenticated users

Discovery Timeline

2026-08-11 - CVE-2026-72556 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-72556

Vulnerability Analysis

ZoneMinder implements filter-based automation that allows users to define conditions and execute actions when matches occur. Access to modify or delete these filters is gated by the canEdit() and canDelete() methods on the Filter class. These methods delegate to permission-checking routines on the ZM\User object.

The delegation calls methods that do not exist on the ZM\User class. PHP dispatches undefined method invocations through the __call() magic method. In this codebase, __call() returns a truthy value by default, causing the permission gate to always evaluate as authorized. Every authenticated user, including low-privilege accounts, gains write access to filter definitions.

Because filter actions can invoke operating system commands, an attacker who edits a filter can inject arbitrary shell commands. Execution occurs in the context of the ZoneMinder service account, providing a direct path from low-privilege authentication to host compromise.

Root Cause

The root cause is a broken authorization check produced by dynamic method dispatch. The Filter class calls methods on ZM\User that were never implemented. Instead of failing closed, PHP's __call() handler returns a truthy value, making the permission check always succeed [CWE-78 combined with broken access control].

Attack Vector

Exploitation requires network access to the ZoneMinder web interface and any valid authenticated session. The attacker authenticates, creates or modifies a filter with a shell command payload in its action field, and triggers the filter. The web application executes the command on the host with the privileges of the ZoneMinder process. No user interaction from an administrator is required.

No verified public proof-of-concept code is available. Refer to the ZoneMinder GitHub repository for source-level details of the Filter class and its permission checks.

Detection Methods for CVE-2026-72556

Indicators of Compromise

Unexpected child processes spawned by the ZoneMinder web server or PHP-FPM worker (for example sh, bash, wget, curl, nc).
New or modified filter entries in the ZoneMinder database referencing shell metacharacters or external URLs in their action fields.
Outbound network connections from the ZoneMinder host to attacker-controlled infrastructure following filter edits.

Detection Strategies

Monitor process ancestry to flag any shell or scripting interpreter whose parent is the ZoneMinder web process.
Enable web server access logging and audit POST requests to filter management endpoints from non-administrative user sessions.
Correlate ZoneMinder audit logs with endpoint telemetry to identify authenticated users creating filters that execute commands.

Monitoring Recommendations

Alert on modifications to ZoneMinder filter records by accounts without administrative role assignments.
Watch for anomalous outbound traffic and file writes originating from the ZoneMinder service account.
Baseline normal filter action content and alert on deviations that include shell operators such as ;, |, &&, or backticks.

How to Mitigate CVE-2026-72556

Immediate Actions Required

Restrict network access to the ZoneMinder web interface to trusted management networks or VPN users only.
Audit all existing user accounts and disable or remove any non-essential authenticated users.
Review current filter definitions for unexpected shell commands and remove any suspicious entries.

Patch Information

At time of publication, no fixed version identifier is listed in the NVD entry. Monitor the ZoneMinder GitHub repository for a release that repairs the canEdit() and canDelete() methods on the Filter class and enforces fail-closed behavior for undefined ZM\User methods.

Workarounds

Place the ZoneMinder web UI behind an authenticating reverse proxy that restricts access to administrative operators.
Temporarily disable the filter subsystem or run ZoneMinder under a service account with minimal shell and filesystem privileges.
Apply mandatory access controls such as AppArmor or SELinux profiles to constrain command execution by the ZoneMinder process.

bash

# Configuration example: restrict access to the ZoneMinder web UI via nginx
location /zm/ {
    allow 10.0.0.0/24;      # trusted management subnet
    deny  all;
    auth_basic "ZoneMinder Admin";
    auth_basic_user_file /etc/nginx/.htpasswd;
    proxy_pass http://127.0.0.1:8080;
}