CVE-2026-30971

ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.39.2, 1.38.2, and 1.36.40, ZoneMinder interpolates an unvalidated monitor Device field into shell commands in PHP and Perl control paths when an authenticated user with monitor-create or monitor-edit permission saves a Local monitor whose Device Path contains shell metacharacters and the monitor control or startup path runs. In this attack mechanism, the stored Device value reaches Perl qx() and backtick execution before zmdc.pl argument detainting, while separate PHP command paths use bypassable escapeshellcmd defenses. The attacker can execute arbitrary commands as the web server user. This vulnerability is fixed in 1.39.2, 1.38.2, and 1.36.40.

• CWE-78

• https://github.com/ZoneMinder/zoneminder/commit/419846c8750c3f45b9b8a1df8cd49c189a14dc03
• https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-g66m-77fq-79v9
• https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-g66m-77fq-79v9

Published

Oct 16, 2026

Last Modified

Oct 16, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-30965Parse Server is an open source backend that can be deployed …9.1
• CVE-2026-30966Parse Server is an open source backend that can be deployed …10
• CVE-2026-30967Parse Server is an open source backend that can be deployed …8.8
• CVE-2026-30968Coral Server is open collaboration infrastructure that enabl…9.8
• CVE-2026-30969Coral Server is open collaboration infrastructure that enabl…9.1
• CVE-2026-30970Coral Server is open collaboration infrastructure that enabl…9.1
• CVE-2026-30972Parse Server is an open source backend that can be deployed …7.5
• CVE-2026-30973Appium is an automation framework that provides WebDriver-ba…6.5
• CVE-2026-30974Copyparty is a portable file server. Prior to v1.20.11., the…5.4
• CVE-2026-30975Sonarr is a PVR for Usenet and BitTorrent users. Versions pr…9.8
• CVE-2026-30976Sonarr is a PVR for Usenet and BitTorrent users. In versions…7.5
• CVE-2026-30977RenderBlocking is a MediaWiki extension that allows interfac…2