CVE-2026-102607 ZoneMinder: Authenticated OS Command Injection (RCE) via Export Feature
Authenticated attackers can execute arbitrary OS commands via crafted export parameters in ZoneMinder, requiring specific permissions and settings.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-102607?
CVE-2026-102607 is a high-severity command injection vulnerability in zoneminder, published on 16 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, the exportEvents() function concatenates the attacker-controlled exportFile request parameter into a shell command without neutralizing shell metacharacters when an authenticated user with View Events or View Snapshots permission submits an event export request with a crafted exportFile value, a valid CSRF token, and exportDetail enabled. The affected components are exportEvents(), exportFile, web/ajax/event.php, web/skins/classic/includes/export_functions.php. In this attack mechanism, the crafted exportFile value reaches the trailing directory argument of a tar or zip command executed by exec(). The attacker can execute arbitrary operating system commands as the web server user. This issue is fixed in version 1.38.3.
Weakness: CWE-78
Which versions are affected by CVE-2026-102607?
How do I fix CVE-2026-102607?
No fix has been published for CVE-2026-102607 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-102607 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-102607 exists.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as DEBIAN-CVE-2026-102607, GHSA-7j62-cjxp-3cj5, UBUNTU-CVE-2026-102607.