{"id":"CVE-2026-30971","kind":"vulnerability","aliases":["CVE-2026-30971"],"related":[],"title":"ZoneMinder: monitor Device field lets an editor run shell commands","description":"ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.39.2, 1.38.2, and 1.36.40, ZoneMinder interpolates an unvalidated monitor Device field into shell commands in PHP and Perl control paths when an authenticated user with monitor-create or monitor-edit permission saves a Local monitor whose Device Path contains shell metacharacters and the monitor control or startup path runs. In this attack mechanism, the stored Device value reaches Perl qx() and backtick execution before zmdc.pl argument detainting, while separate PHP command paths use bypassable escapeshellcmd defenses. The attacker can execute arbitrary commands as the web server user. This vulnerability is fixed in 1.39.2, 1.38.2, and 1.36.40.","summary":"ZoneMinder, an open source CCTV application, passes an unvalidated monitor Device path into shell commands. A user with monitor-create or monitor-edit permission can run arbitrary commands as the web server user.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cctv","package","self-hosted","zoneminder"],"not_affected_if":["auth-required","no-local-monitors"],"how_to_check":"Check the ZoneMinder version (unknown how to read it from the sources); list Local monitors whose Device Path contains shell metacharacters such as ; | ` $ ( ).","fix":"Upgrade to 1.39.2, 1.38.2, or 1.36.40 depending on your release line.\nUntil then, restrict monitor-create and monitor-edit permissions to trusted users.","status":"open","published_at":"2026-10-16T20:17:23+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-23T22:33:18+00:00","updated_at":"2026-10-23T22:33:18+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T22:33:18Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade to 1.39.2, 1.38.2, or 1.36.40 depending on your release line.\nUntil then, restrict monitor-create and monitor-edit permissions to trusted users.","reach":"network","title":"ZoneMinder: monitor Device field lets an editor run shell commands","impact":"high","summary":"ZoneMinder, an open source CCTV application, passes an unvalidated monitor Device path into shell commands. A user with monitor-create or monitor-edit permission can run arbitrary commands as the web server user.","category":"package","who_cares":["zoneminder","self-hosted","cctv"],"confidence":0.8,"needs_auth":"yes","worst_case":"Attacker runs arbitrary commands as the web server user.","analyst_note":"","how_to_check":"Check the ZoneMinder version (unknown how to read it from the sources); list Local monitors whose Device Path contains shell metacharacters such as ; | ` $ ( ).","needs_analyst":false,"not_affected_if":["auth-required","no-local-monitors"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000508,"input_tokens":3064,"output_tokens":403,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-30971':13A,16A '1.36.40':75C,169C '1.38.2':73C,167C '1.39.2':72C,166C 'applic':28B,69C 'arbitrari':51B,154C 'argument':139C 'attack':125C,151C 'authent':94C 'backtick':135C 'bypass':147C 'cctv':17B,27B 'circuit':66C 'close':65C 'closed-circuit':64C 'command':10A,37B,52B,85C,144C,155C 'contain':112C 'control':90C,118C 'creat':43B,99C 'cve':11A,14A 'defens':149C 'detaint':140C 'devic':3A,33B,81C,110C,129C 'edit':47B,103C 'editor':7A 'escapeshellcmd':148C 'execut':136C,153C 'field':4A,82C 'fix':164C 'free':61C 'host':21B 'interpol':77C 'let':5A 'local':107C 'mechan':126C 'metacharact':114C 'monitor':2A,32B,42B,46B,80C,98C,102C,108C,117C 'monitor-cr':41B,97C 'monitor-edit':45B,101C 'open':25B,62C 'packag':18B 'pass':29B 'path':34B,91C,111C,121C,145C 'perl':89C,132C 'permiss':48B,104C 'php':87C,143C 'prior':70C 'qx':133C 'reach':131C 'run':8A,50B,122C 'save':105C 'self':20B 'self-host':19B 'separ':142C 'server':56B,159C 'shell':9A,36B,84C,113C 'softwar':68C 'sourc':26B,63C 'startup':120C 'store':128C 'televis':67C 'unvalid':31B,79C 'use':146C 'user':39B,57B,95C,160C 'valu':130C 'vulner':162C 'web':55B,158C 'whose':109C 'zmdc.pl':138C 'zonemind':1A,22B,23B,58C,76C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T20:17:23+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-30971","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-30971","severity":null,"published_at":"2026-10-16T20:17:23+00:00","modified_at":"2026-10-16T20:17:23+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}