Description

An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HTTP request parameter is passed unsanitized into a shell command executed via PHP's exec(), allowing any authenticated user with View Events permission to execute arbitrary operating system commands on the server.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-28T00:18:14.273Z",
  "pubdate": "2026-08-28T00:18:14.273Z",
  "executiveSummary": "This vulnerability is an authenticated OS command injection flaw identified within the event export functionality of ZoneMinder.\nThe vulnerability arises due to the improper sanitization of the exportFile HTTP request parameter before it is passed to the underlying operating system shell via PHP's exec() function.\nSuccessful exploitation allows an authenticated attacker possessing 'View Events' privileges to achieve remote code execution (RCE) on the host server with the permissions of the web server user.\nThe risk implication is critical, as it facilitates full system compromise, unauthorized data exfiltration, and potential lateral movement within the network.\nExploitation requires an active session with valid authentication credentials and appropriate authorization to access event export features.\nThis flaw underscores the danger of passing unsanitized user-supplied input directly into system execution functions.",
  "technicalDetails": "The vulnerability resides in the event export module of ZoneMinder, where user-supplied input is insufficiently validated before being integrated into a command line string executed by the PHP interpreter.\nSpecifically, the 'exportFile' parameter is received through an HTTP request and is passed directly into a shell execution context via the exec() function. Because the application fails to perform adequate input sanitization or parameterization, an attacker can escape the intended command structure by injecting malicious shell metacharacters (e.g., ;, &&, |, or backticks).\nThe attack flow commences when an authenticated user triggers an event export request, manipulating the 'exportFile' parameter to include a crafted payload. For example, by appending a semicolon followed by an arbitrary OS command (e.g., 'exportFile=test.jpg; id'), the attacker forces the underlying shell to execute the injected command after the intended export operation is attempted.\nBecause the execution occurs within the context of the web server process (typically www-data or similar), the attacker inherits the system privileges associated with that user. This grants the attacker capabilities to perform unauthorized actions such as arbitrary file reads, modification of configuration files, execution of reverse shells, or the deployment of persistent backdoors.\nThe vulnerability is primarily rooted in the reliance on string concatenation when building command strings rather than utilizing safe, library-based alternatives that prevent shell interpretation of arguments. The lack of strict regex-based allow-listing or character blacklisting for the input parameter allows the shell to interpret the injected control characters as command separators, leading to command chaining.\nThis attack vector does not require physical access or pre-existing network misconfigurations beyond the availability of the web interface; it is purely a logic flaw within the application layer. The exposure is constrained to users who have been granted the 'View Events' permission, meaning that while the attack is authenticated, the threshold for exploitability is relatively low in environments where user roles are loosely managed."
}