CVE-2023-26038 ZoneMinder contains Local File Inclusion vulnerability via `web/ajax/modal.php`
Attackers can exploit a Local File Inclusion vulnerability in ZoneMinder to load arbitrary PHP files, potentially leading to code execution or data disclosure.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-26038?
CVE-2023-26038 is a medium-severity path traversal vulnerability in Zoneminder Zoneminder, published on 25 Feb 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 and 1.37.33 contain a Local File Inclusion (Untrusted Search Path) vulnerability via web/ajax/modal.php, where an arbitrary php file path can be passed in the request and loaded. This issue is patched in versions 1.36.33 and 1.37.33.
Weakness: CWE-426
Which versions are affected by CVE-2023-26038?
It affects 1 product.
Products include Zoneminder Zoneminder.
How do I fix CVE-2023-26038?
Upgrade to a fixed version.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2023-26038 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-26038 exists.
Other vulnerabilities in Zoneminder Zoneminder
Sources
Also known as DEBIAN-CVE-2023-26038, GHSA-wrx3-r8c4-r24w, UBUNTU-CVE-2023-26038.