Live › vulnerability › CVE-2026-30971
Go to dashboardZoneMinder, an open source CCTV application, passes an unvalidated monitor Device path into shell commands. A user with monitor-create or monitor-edit permission can run arbitrary commands as the web server user.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
Check the ZoneMinder version (unknown how to read it from the sources); list Local monitors whose Device Path contains shell metacharacters such as ; | ` $ ( ).
1.39.2, 1.38.2, or 1.36.40 depending on your release lineEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.39.2, 1.38.2, and 1.36.40, ZoneMinder interpolates an unvalidated monitor Device field into shell commands in PHP and Perl control paths when an authenticated user with monitor-create or monitor-edit permission saves a Local monitor whose Device Path contains shell metacharacters and the monitor control or startup path runs. In this attack mechanism, the stored Device value reaches Perl qx() and backtick execution before zmdc.pl argument detainting, while separate PHP command paths use bypassable escapeshellcmd defenses. The attacker can execute arbitrary commands as the web server user. This vulnerability is fixed in 1.39.2, 1.38.2, and 1.36.40.
This page as .md · .json · in your agent: get_signal("CVE-2026-30971")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.