---
id: "CVE-2026-30971"
kind: "vulnerability"
aliases: ["CVE-2026-30971"]
title: "ZoneMinder: monitor Device field lets an editor run shell commands"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["cctv", "package", "self-hosted", "zoneminder"]
not_affected_if: ["auth-required", "no-local-monitors"]
published_at: "2026-10-16T20:17:23+00:00"
first_seen_at: "2026-10-23T21:57:14+00:00"
updated_at: "2026-10-23T22:33:18+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-30971", "first_seen_at": "2026-10-23T21:57:14+00:00"}]
---

# ZoneMinder: monitor Device field lets an editor run shell commands

ZoneMinder, an open source CCTV application, passes an unvalidated monitor Device path into shell commands. A user with monitor-create or monitor-edit permission can run arbitrary commands as the web server user.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Check the ZoneMinder version (unknown how to read it from the sources); list Local monitors whose Device Path contains shell metacharacters such as ; | ` $ ( ).

## Fix

Upgrade to 1.39.2, 1.38.2, or 1.36.40 depending on your release line.
Until then, restrict monitor-create and monitor-edit permissions to trusted users.

## Timeline

- 2026-10-23T21:57:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-30971

## From the sources

ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.39.2, 1.38.2, and 1.36.40, ZoneMinder interpolates an unvalidated monitor Device field into shell commands in PHP and Perl control paths when an authenticated user with monitor-create or monitor-edit permission saves a Local monitor whose Device Path contains shell metacharacters and the monitor control or startup path runs. In this attack mechanism, the stored Device value reaches Perl qx() and backtick execution before zmdc.pl argument detainting, while separate PHP command paths use bypassable escapeshellcmd defenses. The attacker can execute arbitrary commands as the web server user. This vulnerability is fixed in 1.39.2, 1.38.2, and 1.36.40.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_