Does ZoneMinder Shell Injection Threaten Your Video Surveillance Stack?

ZoneMinder released version 1.38.3 to address a critical remote code execution vulnerability identified as CVE-2026-102608. This flaw allows attackers to run arbitrary commands on systems running older versions of the open-source closed-circuit television software. Security operations teams must verify their installations against this version threshold immediately to prevent unauthorized access.

The vulnerability stems from improper input validation within the downloadEvents function. According to the National Vulnerability Database record, the application manually wraps monitor names in single quotes rather than using the escapeshellarg function. This oversight occurs when a user with monitor creation or editing permissions saves a name containing shell metacharacters. Subsequently, any user with event viewing permissions can trigger the exploit by exporting events for that specific monitor.

Mechanism and Impact

The stored monitor name bypasses manual quoting controls and injects into shell commands. The injection reaches both the ffmpeg concatenation command and the tar or zip archive command. This allows the attacker to break out of the intended command structure. Consequently, arbitrary commands execute with the privileges of the web server user. The Common Weakness Enumeration classifies this as CWE-78, indicating improper neutralization of special elements used in an OS command.

Affected Versions

The flaw impacts ZoneMinder installations running version 1.37.48 and any subsequent release prior to 1.38.3. The NVD record explicitly defines the affected range as >= 1.37.48 and < 1.38.3. Organizations using version 1.38.3 are not subject to this specific vulnerability. Administrators should audit their deployment to ensure no legacy versions remain in production environments.

Next steps

Administrators should update their ZoneMinder installations to version 1.38.3 or later. This update includes the fix for CVE-2026-102608. Teams should verify that the update applies correctly and that the web server service restarts without error. Confirming the version number via the application interface or command line is recommended to ensure the patch is active.

Signals worth monitoring

Teams usually review web server access logs for unusual HTTP requests targeting event export endpoints. Check whether any requests contain complex strings or special characters in monitor name parameters. Look for evidence of new processes spawned by the web server user, particularly ffmpeg, tar, or zip utilities. Monitor for outbound connections from the surveillance server that do not match baseline network traffic patterns. Investigate any sudden changes to system files or new user accounts created on the host machine.

What to do and how to stay safe: ZoneMinder

• Update ZoneMinder to version 1.38.3 or later to apply the confirmed fix.
• Audit monitor names in the database for shell metacharacters and sanitize them.
• Review web server logs for requests to downloadEvents with suspicious parameters.
• Implement network segmentation to limit web server access to other internal systems.

Step-by-step guide: Emergency Patching Checklist for Critical System Fixes

General security guidance from the SecOps Monitor newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-102608?

The source material does not provide a specific CVSS score, only that it is rated as critical in the NVD record header context.

Which permissions are required to exploit this flaw?

An attacker needs monitor-create or monitor-edit permission to store the malicious name, and Events View permission to export the events.

Is version 1.38.2 affected by this vulnerability?

Yes, version 1.38.2 is affected because the fix is only available in version 1.38.3 and later.