{"id":"CVE-2026-102607","kind":"vulnerability","aliases":["CVE-2026-102607"],"related":[],"title":"ZoneMinder: authenticated users can run OS commands through event export","description":"ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, the exportEvents() function concatenates the attacker-controlled exportFile request parameter into a shell command without neutralizing shell metacharacters when an authenticated user with View Events or View Snapshots permission submits an event export request with a crafted exportFile value, a valid CSRF token, and exportDetail enabled. The affected components are exportEvents(), exportFile, web/ajax/event.php, web/skins/classic/includes/export_functions.php. In this attack mechanism, the crafted exportFile value reaches the trailing directory argument of a tar or zip command executed by exec(). The attacker can execute arbitrary operating system commands as the web server user. This issue is fixed in version 1.38.3.","summary":"ZoneMinder builds a shell command from the exportFile request parameter without escaping it, so a crafted value is passed to tar or zip. An attacker with View Events or View Snapshots permission can run arbitrary operating system commands as the web server user.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["linux","other","self-hosted","zoneminder"],"not_affected_if":["exportdetail-disabled","version-1.38.3-or-later"],"how_to_check":"Check that the installed ZoneMinder version is below 1.38.3. Check whether the exportDetail option is enabled.","fix":"Upgrade ZoneMinder to version 1.38.3 or later.","status":"open","published_at":"2026-10-16T20:17:17+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-23T22:33:22+00:00","updated_at":"2026-10-23T22:33:22+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-10-23T22:33:22Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade ZoneMinder to version 1.38.3 or later.","reach":"internet","title":"ZoneMinder: authenticated users can run OS commands through event export","impact":"high","summary":"ZoneMinder builds a shell command from the exportFile request parameter without escaping it, so a crafted value is passed to tar or zip. An attacker with View Events or View Snapshots permission can run arbitrary operating system commands as the web server user.","category":"other","who_cares":["zoneminder","self-hosted","linux"],"confidence":0.8,"needs_auth":"yes","worst_case":"Arbitrary OS commands run as the web server user.","analyst_note":"","how_to_check":"Check that the installed ZoneMinder version is below 1.38.3. Check whether the exportDetail option is enabled.","needs_analyst":false,"not_affected_if":["version-1.38.3-or-later","exportdetail-disabled"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000853,"input_tokens":3059,"output_tokens":1094,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-102607':13A,16A '-2026':12A,15A '1.38.3':80C,177C 'affect':129C 'applic':77C 'arbitrari':57B,162C 'argument':148C 'attack':47B,87C,138C,159C 'attacker-control':86C 'authent':2A,102C 'build':24B 'circuit':74C 'close':73C 'closed-circuit':72C 'command':7A,27B,60B,95C,154C,165C 'compon':130C 'concaten':84C 'control':88C 'craft':38B,118C,141C 'csrf':123C 'cve':11A,14A 'directori':147C 'enabl':127C 'escap':34B 'event':9A,50B,106C,113C 'exec':157C 'execut':155C,161C 'export':10A,114C 'exportdetail':126C 'exportev':82C,132C 'exportfil':30B,89C,119C,133C,142C 'fix':174C 'free':69C 'function':83C 'host':21B 'issu':172C 'linux':17B 'mechan':139C 'metacharact':99C 'neutral':97C 'open':70C 'oper':58B,163C 'os':6A 'paramet':32B,91C 'pass':41B 'permiss':54B,110C 'prior':78C 'reach':144C 'request':31B,90C,115C 'run':5A,56B 'self':20B 'self-host':19B 'server':64B,169C 'shell':26B,94C,98C 'snapshot':53B,109C 'softwar':76C 'sourc':71C 'submit':111C 'system':59B,164C 'tar':43B,151C 'televis':75C 'token':124C 'trail':146C 'user':3A,65B,103C,170C 'valid':122C 'valu':39B,120C,143C 'version':176C 'view':49B,52B,105C,108C 'web':63B,168C 'web/ajax/event.php':134C 'web/skins/classic/includes/export_functions.php':135C 'without':33B,96C 'zip':45B,153C 'zonemind':1A,22B,23B,66C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T20:17:17+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-102607","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102607","severity":null,"published_at":"2026-10-16T20:17:17+00:00","modified_at":"2026-10-19T15:16:53+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}