CVE catalog

CVE-2026-102608

ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, downloadEvents() manually wraps a monitor Name value in single quotes instead of using escapeshellarg

[CVE catalog]

Severity
Critical · CVSS 9CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Published
Updated
Source
[NVD] · [CVE record]
EPSS
0.29% · Oct 25, 2026

ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, downloadEvents() manually wraps a monitor Name value in single quotes instead of using escapeshellarg() before placing it in shell commands when a user with monitor-create or monitor-edit permission stores a monitor Name containing shell metacharacters and a user with Events View permission exports that monitor's events. In this attack mechanism, the stored monitor Name reaches both the ffmpeg concatenation command and the tar or zip archive command and breaks out of manual quoting. Arbitrary commands execute as the web server user. This issue is fixed in version 1.38.3.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianzonemindersid1.36.37+dfsg1-1.1vulnerable
Debianzoneminderforky1.36.37+dfsg1-1.1vulnerable
Debianzonemindertrixie1.36.35+dfsg1-1vulnerable
Debianzoneminderbookworm1.36.33+dfsg1-1vulnerable
Ubuntuzoneminderpro1.36.7+dfsg1-1vulnerable
Ubuntuzoneminderpro1.36.10+dfsg1-1vulnerable
Ubuntuzoneminderpro1.36.11+dfsg1-1vulnerable
Ubuntuzoneminderpro1.36.12+dfsg1-1vulnerable
Ubuntuzoneminderpro1.36.12+dfsg1-1ubuntu0.1~esm1vulnerable
Ubuntuzoneminder24.041.36.33+dfsg1-1build1vulnerable
Ubuntuzoneminder24.041.36.33+dfsg1-1build2vulnerable
Ubuntuzoneminder24.041.36.33+dfsg1-1build3vulnerable
Ubuntuzoneminder24.041.36.33+dfsg1-1build4vulnerable
Ubuntuzoneminder26.101.36.37+dfsg1-1vulnerable
Ubuntuzoneminder26.041.36.35+dfsg1-1vulnerable
Ubuntuzoneminder26.041.36.37+dfsg1-1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianzonemindersourcesid(unfixed)unimportantNot reportedNot reported
Debianzonemindersourceforky(unfixed)unimportantNot reportedNot reported
Debianzonemindersourcetrixie(unfixed)unimportantNot reportedNot reported
Debianzonemindersourcebookworm(unfixed)unimportantNot reportedNot reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [zoneminder]Affected
    Details (2)

    • 1.36.33+dfsg1-1 · amd64 · bookworm

      Affected

      nvd · zoneminder · debian · bookworm; nvd · zoneminder · debian · 12

    • 1.36.33+dfsg1-1 · arm64 · bookworm

      Affected

      nvd · zoneminder · debian · bookworm; nvd · zoneminder · debian · 12

  • [zoneminder-doc]Affected

    Source package: [zoneminder]

    Details (2)

    • 1.36.33+dfsg1-1 · all · bookworm

      Affected

      nvd · zoneminder · debian · bookworm; nvd · zoneminder · debian · 12

    • 1.36.33+dfsg1-1 · all · bookworm

      Affected

      nvd · zoneminder · debian · bookworm; nvd · zoneminder · debian · 12

[Debian 13 (Trixie)]

  • [zoneminder]Affected
    Details (2)

    • 1.36.35+dfsg1-1 · amd64 · trixie

      Affected

      nvd · zoneminder · debian · 13

    • 1.36.35+dfsg1-1 · arm64 · trixie

      Affected

      nvd · zoneminder · debian · 13

  • [zoneminder-doc]Affected

    Source package: [zoneminder]

    Details (2)

    • 1.36.35+dfsg1-1 · all · trixie

      Affected

      nvd · zoneminder · debian · 13

    • 1.36.35+dfsg1-1 · all · trixie

      Affected

      nvd · zoneminder · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database]