CVE-2026-76060

ZoneMinder, an open-source video surveillance/NVR platform, contains an OS command injection flaw (CWE-78) in its event export functionality. The exportFile HTTP request parameter is passed into a shell command without sanitization and executed via PHP's exec(), so any authenticated user holding the View Events permission can trigger it over the network. Successful exploitation yields arbitrary operating-system command execution on the ZoneMinder server with the privileges of the web server process, consistent with the high CVSS 4.0 score of 8.7 and high impact on confidentiality, integrity, and availability of the system. Any ZoneMinder deployment is affected, though an attacker must first have (or obtain) an account with View Events permission; the affected version range is not stated in the available data. No public proof-of-concept or in-the-wild exploitation is known so far; the issue is not in CISA KEV and carries a 2.3% EPSS probability of exploitation within 30 days.

What to do: Upgrade ZoneMinder to a patched release as soon as the vendor publishes one (no fixed version is stated in the current data), and treat any release announcement from the project or CISA ICS as the trigger to update. Until then, minimize exposure: keep ZoneMinder behind a VPN or authenticated reverse proxy, limit accounts with View Events permission on internet-facing servers, and restrict or monitor access to the event export endpoint. Check web-server access and audit logs for unexpected exportFile parameter values or spawning of shell processes by the web server user.