ZoneMinder Authenticated OS Command Injection via Monitor Name

ZoneMinder, an open-source closed-circuit television (CCTV) software, contains a critical OS command injection vulnerability tracked as CVE-2026-102608. The issue stems from the improper sanitization of the 'Monitor Name' field within the download_functions.php script. Specifically, the application uses manual single-quote wrapping instead of robust functions like escapeshellarg() when constructing command-line arguments for system utilities including ffmpeg, tar, and zip.

An attacker possessing monitor-create or monitor-edit permissions can inject shell metacharacters into a monitor name. When a user with 'Events View' permissions triggers an event export for that monitor, the malicious input breaks out of the manual quoting, leading to arbitrary command execution in the context of the web server user. This vulnerability is fixed in version 1.38.3. Given the public availability of proof-of-concept exploit code, immediate patching is required for all instances.

Attack Chain

1. The attacker gains initial access to the ZoneMinder web interface with credentials possessing monitor-create or monitor-edit privileges.
2. The attacker navigates to the monitor configuration and creates or renames a monitor, inserting shell metacharacters (e.g., ;, &&, $()) into the 'Monitor Name' field.
3. The malicious monitor name is saved into the backend database.
4. An authenticated user with 'Events View' permissions initiates an event export process for the compromised monitor.
5. The download_functions.php script retrieves the monitor name from the database.
6. The script improperly concatenates the name into shell commands for ffmpeg, tar, or zip utilities.
7. The system executes the injected commands as the web server user process (e.g., www-data).
8. Final objective achieved: remote command execution, potential lateral movement, or system compromise.

Impact

Successful exploitation allows for full remote code execution on the underlying server as the web server user. This provides the attacker the ability to pivot deeper into the internal network, exfiltrate stored CCTV footage, or disrupt surveillance operations. This vulnerability is rated with a CVSS 9.0 (High) score, posing a significant risk to organizations relying on ZoneMinder for physical security monitoring.

Recommendation

• Upgrade ZoneMinder to version 1.38.3 or later immediately to patch CVE-2026-102608.
• Audit existing monitor names for the presence of shell metacharacters such as semicolon, pipe, or backticks using the web interface or direct database queries.
• Review web server access logs for anomalous requests to download_functions.php that include excessive query parameters or shell metacharacters.
• Enforce strict role-based access control (RBAC) to limit the number of users with monitor-create or monitor-edit permissions.