CVE-2026-102607

ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, the exportEvents() function concatenates the attacker-controlled exportFile request parameter into a shell command without neutralizing shell metacharacters when an authenticated user with View Events or View Snapshots permission submits an event export request with a crafted exportFile value, a valid CSRF token, and exportDetail enabled. The affected components are exportEvents(), exportFile, web/ajax/event.php, web/skins/classic/includes/export_functions.php. In this attack mechanism, the crafted exportFile value reaches the trailing directory argument of a tar or zip command executed by exec(). The attacker can execute arbitrary operating system commands as the web server user. This issue is fixed in version 1.38.3.

• CWE-78

• https://github.com/ZoneMinder/zoneminder/commit/548ed87d47a49c17b4c842f6fee8a08660deb427
• https://github.com/ZoneMinder/zoneminder/commit/605f962b7b6ba7f5780b3e6715b5418b8b2addca
• https://github.com/ZoneMinder/zoneminder/releases/tag/1.38.3
• https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-7j62-cjxp-3cj5
• https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-7j62-cjxp-3cj5

Published

Oct 16, 2026

Last Modified

Oct 19, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-102598Werkzeug is a comprehensive WSGI web application library. Pr…6.3
• CVE-2026-102599Socket.IO enables bidirectional and low-latency communicatio…7.5
• CVE-2026-10260A vulnerability was detected in CodeAstro Online Job Portal …7.3
• CVE-2026-102600Socket.IO enables bidirectional and low-latency communicatio…7.5
• CVE-2026-102601Flysystem is an open source file storage library for PHP. Pr…3.5
• CVE-2026-102603Gotify server is a simple server for sending and receiving m…5.3
• CVE-2026-102608ZoneMinder is a free, open source closed-circuit television …9
• CVE-2026-10261A flaw has been found in CodeAstro Online Job Portal 1.0. Th…7.3
• CVE-2026-102615HeyForm is an open-source form builder. Prior to 3.0.1, /api…7.6
• CVE-2026-102616A vulnerability was detected in risesoft-y9 WorkFlow-Engine …7.3
• CVE-2026-10262A vulnerability has been found in code-projects Real State S…7.3
• CVE-2026-102620A vulnerability was determined in Freedesktop Poppler 26.06.…3.3