Zoneminder
view advisory published 2026-08-25
Successful exploitation of this vulnerability could result in full Remote Code Execution (RCE) as the web server user.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-76060US | — | Exploit | ||
An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HTTP request parameter is passed unsanitized into a shell comm… | ||||
02
references
External citations — patches, advisories, analysis.
- ICS Advisory ICSA-26-237-02 JSONself
- ICSA Advisory ICSA-26-237-02 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
03
remediations (1)
- Fixedzoneminder
Users may also get the source code from Zoneminder's Github: https://github.com/ZoneMinder/zoneminder.
https://github.com/ZoneMinder/zoneminder
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan