Key points
- ZoneMinder versions prior to 1.38.3 contain a high-severity command injection flaw.
- Attackers need valid credentials and a CSRF token to exploit the export function.
- Version 1.38.3 is available and resolves the vulnerability in the web interface.
ZoneMinder versions older than 1.38.2 are affected by CVE-2026-102607, a high-severity vulnerability rated 8.8 on the CVSS scale. The National Vulnerability Database records this issue as a command injection flaw within the application’s event export feature. Users running any version before the latest release are exposed to potential arbitrary command execution attacks if an attacker can authenticate and submit a crafted request.
In plain English
The vulnerability exists in how ZoneMinder handles file exports. When an authenticated user requests an export of events or snapshots, the software takes the filename provided in the request and inserts it directly into a system command. The application fails to remove special characters that have meaning to the operating system shell. This allows a malicious actor to append additional commands to the export request.
The background
To exploit this flaw, an attacker must first log in to the ZoneMinder interface with an account that has permission to view events or snapshots. They also need a valid Cross-Site Request Forgery token. By crafting a specific value for the export file parameter and enabling detailed exports, the attacker can inject commands into the tar or zip utility. This runs the injected code with the privileges of the web server user.
What changes now
ZoneMinder has released version 1.38.3 to address this security gap. This update resolves the issue in the web interface components where the vulnerability was identified. The fix applies to the ajax and classic skin components. Users who update to this version eliminate the risk of arbitrary command execution through the export feature.
Who needs to act first
Teams managing surveillance infrastructure should prioritize updating publicly accessible ZoneMinder instances immediately. Systems exposed to the internet face the highest risk because they are visible to automated scanners and targeted attackers. Before applying the patch to production environments, verify the update in a test setting to ensure camera feeds and recording schedules function correctly. Back up configuration files and database states to allow for quick rollback if the new version causes compatibility issues with existing hardware or plugins.
Background: Cross-site request forgery (CSRF)
Cross-site request forgery tricks users into executing unwanted actions on trusted sites. Protect your business by enforcing same-site cookies and validating request origins. Verify that your web applications use anti-forgery tokens and restrict sensitive operations to secure contexts.
Read the full guide: CSRF Risks and Protection: Secure Your Business Web Apps
What to do and how to stay safe: ZoneMinder
- Verify your current ZoneMinder version by checking the system information page in the web interface.
- Download and install version 1.38.3 on all servers running older builds of the software.
- Review user accounts to ensure only necessary personnel have permissions to view or export events.
- Monitor system logs for unusual command executions or unexpected process starts after the update.
Step-by-step guide: Out-of-Band Patches: Meaning, Risks, and Deployment Reality
General security guidance from the Patch Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Do I need to be logged in to exploit this flaw?
Yes, the attacker must have an authenticated account with permission to view events or snapshots.
Which specific function is vulnerable?
The exportEvents() function in the web/ajax/event.php and export_functions.php components is affected.
Is there a fix available?
Yes, ZoneMinder version 1.38.3 fixes this issue and is available for download.
