CVE-2026-72556
HighCVSS 8.8Summary
A remote code execution vulnerability in ZoneMinder 1.39.17 allows any authenticated user to execute OS commands by exploiting a broken permission check in the Filter class. canEdit() and canDelete() call nonexistent methods, causing PHP __call() to return truthy and bypass the check.
Risk Assessment
The organization is exposed to full server takeover by any authenticated user, potentially compromising security and system integrity.
Recommendation
Update ZoneMinder to a patched version immediately or manually fix the permission check in the Filter class.
Original NVD description (English source)
A remote code execution vulnerability in ZoneMinder 1.39.17 allows any authenticated user to execute OS commands by exploiting a broken permission check in the Filter class. The canEdit() and canDelete() methods invoke nonexistent methods on the ZM\User class, causing PHP __call() to return a truthy value that bypasses the permission check for all users. Any authenticated user can trigger filter-based OS command execution regardless of their assigned role.