Vulnerabilities

CVSS

8.8 High

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Risk score

70.4

Published

2026-08-27

Status

Published

An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HTTP request parameter is passed unsanitized into a shell command executed via PHP's exec(), allowing any authenticated user with View Events permission to execute arbitrary operating system commands on the server.

Weaknesses

CWE-78

Coverage 1

vulnerability

Zoneminder

A critical Remote Code Execution (RCE) vulnerability exists in Zoneminder versions 1.37.48 and 1.38.3, allowing authenticated users to execute arbitrary operating system commands. The vulnerability stems from an Improper…

CISA Advisories · 5d ago Critical

CVE-2026-76060vulnerabilityrceos command injection

All articles mentioning it

Advisories and references

• zoneminder.com/downloads
• github.com/ZoneMinder/zoneminder
• github.com/ZoneMinder/zoneminder/security/advisories/GHSA-88m4-hrgp-...
• cisa.gov/news-events/ics-advisories/icsa-26-237-02
• github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-2...