CVE-2026-76060
HighCVSS 8.8Exploitation Probability (EPSS)
High risk82th percentile - higher than 82% of all known CVEs
Summary
An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HTTP request parameter is passed unsanitized into a shell command executed via PHP's exec(), allowing any authenticated user with View Events permission to execute arbitrary operating system commands on the server.
Risk Assessment
The risk includes full server compromise by an authenticated user, potentially leading to loss of confidentiality, integrity, and availability of data.
Recommendation
It is recommended to upgrade ZoneMinder to a patched version and sanitize all input parameters before using them in system commands.
Original NVD description (English source)
An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HTTP request parameter is passed unsanitized into a shell command executed via PHP's exec(), allowing any authenticated user with View Events permission to execute arbitrary operating system commands on the server.