ZoneMinder: Authenticated RCE via command injection in monitor Device Path
ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.39.2, 1.38.2, and 1.36.40, ZoneMinder interpolates an unvalidated monitor Device field into shell commands in PHP and Perl control paths when an authenticated user with monitor-create or monitor-edit permission saves a Local monitor whose Device Path contains shell metacharacters and the monitor control or startup path runs. In this attack mechanism, the stored Device value reaches Perl qx() and backtick execution before zmdc.pl argument detainting, while separate PHP command paths use bypassable escapeshellcmd defenses. The attacker can execute arbitrary commands as the web server user. This vulnerability is fixed in 1.39.2, 1.38.2, and 1.36.40.
CVE-2026-30971
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-30971
zoneminder
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "ZoneMinder",
"product": "zoneminder",
"versions": [
{
"status": "affected",
"version": "< 1.36.40"
},
{
"status": "affected",
"version": ">= 1.38.0, < 1.38.2"
},
{
"status": "affected",
"version": ">= 1.39.0, < 1.39.2"
}
]
}
]- Related CVEs
- CVE-2026-30971
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #34404 · Revision 1
- Added to Heist Feed
- Publisher date