CVE-2026-76060: ZoneMinder RCE Vulnerability via Export

CVE-2026-76060 Overview

CVE-2026-76060 is an authenticated operating system (OS) command injection vulnerability in ZoneMinder's event export functionality. The exportFile HTTP request parameter flows unsanitized into a shell command executed through PHP's exec() function. Any authenticated user holding the View Events permission can inject arbitrary shell metacharacters and execute commands under the web server account. The flaw is tracked as CWE-78: Improper Neutralization of Special Elements used in an OS Command and is addressed in the ZoneMinder GitHub Security Advisory GHSA-88m4-hrgp-m9v3.

Critical Impact
An authenticated low-privilege ZoneMinder user can achieve arbitrary OS command execution on the video management server, exposing recorded footage, camera credentials, and adjacent network segments.

Affected Products

ZoneMinder open-source video management system
Deployments referenced by CISA advisory ICSA-26-237-02
Refer to the ZoneMinder Downloads Page for fixed release versions

Discovery Timeline

2026-08-28 - CVE-2026-76060 published to NVD
2026-08-31 - Last updated in NVD database

Technical Details for CVE-2026-76060

Vulnerability Analysis

ZoneMinder exposes an event export workflow that packages recorded video events for download. The server-side handler accepts an exportFile parameter from the HTTP request and concatenates the value into a shell command string. The concatenated string is then executed through PHP's exec() function. Because the parameter is not filtered, escaped, or validated against an allowlist, attacker-controlled shell metacharacters such as ;, |, backticks, or $() are interpreted by the shell rather than treated as literal filename data.

A valid session with the View Events permission is required, which lowers the exploitation bar in multi-tenant deployments and environments where camera operators, integrators, or auditors receive read-level accounts. Successful exploitation grants code execution as the ZoneMinder web user, typically www-data or apache, which owns configuration files, database credentials, and stored recordings.

Root Cause

The root cause is the direct use of untrusted request input in a shell command context without sanitization or use of a safe process invocation API. PHP's exec() invokes the system shell, so any metacharacter in the concatenated string is parsed by the shell interpreter. Safer alternatives such as escapeshellarg(), proc_open() with argument arrays, or strict allowlists for filename tokens were not applied on this code path.

Attack Vector

An authenticated attacker submits an HTTP request to the event export endpoint and appends shell metacharacters to the exportFile parameter. The injected payload is executed as part of the shell command line, allowing arbitrary binaries and shell built-ins to run. Because the attack vector is network-based and requires only low privileges with no user interaction, exploitation can be scripted against internet-exposed ZoneMinder consoles.

No verified public exploit code was linked in the advisory at the time of writing. See the GitHub Security Advisory GHSA-88m4-hrgp-m9v3 for maintainer-provided technical detail.

Detection Methods for CVE-2026-76060

Indicators of Compromise

HTTP requests to ZoneMinder event export endpoints containing shell metacharacters (;, |, &&, backticks, $()) in the exportFile parameter.
Child processes of the web server user (www-data, apache, or nginx) spawning shells such as sh, bash, curl, wget, nc, or python outside routine export activity.
Outbound network connections from the ZoneMinder host to unfamiliar destinations shortly after event export requests.
New or modified files in web-writable directories, cron entries, or SSH authorized_keys on the ZoneMinder server.

Detection Strategies

Inspect web server access logs for exportFile values that deviate from expected filename patterns and flag those containing shell control characters.
Baseline the process tree of the ZoneMinder web service and alert on unexpected child processes such as reverse shells or reconnaissance utilities.
Correlate authenticated ZoneMinder sessions with subsequent outbound connections from the host to identify command-and-control activity.

Monitoring Recommendations

Forward ZoneMinder web server, PHP-FPM, and auth logs to a centralized SIEM for retention and correlation.
Enable Linux auditd or eBPF-based process telemetry on the ZoneMinder host to capture execve events from the web user.
Monitor for creation of persistence artifacts under paths writable by the web user, including /tmp, /var/tmp, and ZoneMinder cache directories.

How to Mitigate CVE-2026-76060

Immediate Actions Required

Upgrade ZoneMinder to the fixed release listed on the ZoneMinder Downloads Page and referenced in GHSA-88m4-hrgp-m9v3.
Restrict the ZoneMinder web interface to trusted management networks or place it behind a VPN or reverse proxy with authentication.
Audit all ZoneMinder user accounts and revoke the View Events permission from accounts that do not need it.
Review web server, shell history, and system logs for signs of exploitation dating back to the deployment of the affected version.

Patch Information

Apply the vendor-supplied patch published in the ZoneMinder GitHub Security Advisory GHSA-88m4-hrgp-m9v3. Additional operator guidance is available in the CISA ICSA-26-237-02 advisory and machine-readable CSAF data. Source code changes can be reviewed in the ZoneMinder GitHub Repository.

Workarounds

Block or filter export requests at a reverse proxy or web application firewall when the exportFile parameter contains shell metacharacters.
Run the ZoneMinder web service under a dedicated low-privilege account with a restricted shell and no sudo rights.
Apply mandatory access controls such as AppArmor or SELinux profiles that deny the web user from executing shells and network utilities.
Disable the event export feature for user roles that do not require it until the patched version is deployed.

bash

# Example reverse proxy filter (nginx) blocking shell metacharacters in exportFile
# Adjust the location block to match your ZoneMinder path
location /zm/ {
    if ($arg_exportFile ~* "[;&|`$()<>\\]") {
        return 403;
    }
    proxy_pass http://zoneminder_backend;
}