CVE-2026-102608

Name	CVE-2026-102608
Description	ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, downloadEvents() manually wraps a monitor Name value in single quotes instead of using escapeshellarg() before placing it in shell commands when a user with monitor-create or monitor-edit permission stores a monitor Name containing shell metacharacters and a user with Events View permission exports that monitor's events. In this attack mechanism, the stored monitor Name reaches both the ffmpeg concatenation command and the tar or zip archive command and breaks out of manual quoting. Arbitrary commands execute as the web server user. This issue is fixed in version 1.38.3.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
zoneminder (PTS)	bookworm	1.36.33+dfsg1-1	vulnerable
	trixie	1.36.35+dfsg1-1	vulnerable
	forky, sid	1.36.37+dfsg1-1.1	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
zoneminder	source	(unstable)	(unfixed)	unimportant

Notes

https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-88m4-hrgp-m9v3
Fixed by: https://github.com/ZoneMinder/zoneminder/commit/2de2ae44a1d751bad4b020c5573b2d58c59c1525 (1.38.3)
Only supported for trusted users/behind auth