CVE-2025-65791 Command injection in n/a
ZoneMinder is reported to have a command injection vulnerability in image.php, though the vendor disputes the presence of unsanitized input.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-65791?
CVE-2025-65791 is a critical command injection vulnerability in Zoneminder Zoneminder, published on 18 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
ZoneMinder v1.36.34 is vulnerable to Command Injection in web/views/image.php. The application passes unsanitized user input directly to the exec() function. NOTE: this is disputed by the Supplier because there is no unsanitized user input to web/views/image.php.
Weakness: CWE-78
Which versions are affected by CVE-2025-65791?
It affects 1 product.
Products include Zoneminder Zoneminder.
How do I fix CVE-2025-65791?
No fix has been published for CVE-2025-65791 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2025-65791 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-65791 exists.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Zoneminder Zoneminder
Sources
Also known as DEBIAN-CVE-2025-65791, GHSA-xw73-fccw-fgc4, UBUNTU-CVE-2025-65791.