ZoneMinder Command Injection Flaw Patched
An authenticated OS command injection in ZoneMinder's event export feature allows full remote code execution as the web server user.
CISA has published an advisory detailing CVE-2026-76060, an authenticated OS command injection vulnerability affecting ZoneMinder versions 1.37.48 through 1.38.3. The flaw exists in the event export functionality, where the exportFile HTTP request parameter is passed unsanitized into a shell command executed via PHP's exec() function. Any authenticated user with View Events permission can exploit this to execute arbitrary operating system commands on the server, potentially achieving full remote code execution as the web server user.
A public proof-of-concept exploit was discovered by CISA, authored by a researcher going by 'Scriptkittens', and responsibly reported to ZoneMinder. CISA states no known public exploitation targeting this vulnerability has been reported at this time. ZoneMinder is deployed worldwide and used across critical infrastructure sectors as video surveillance and monitoring software.
ZoneMinder recommends upgrading to version 1.38.3 or later, with the fix and further details available via the vendor's GitHub security advisory. CISA also reiterates standard ICS defensive guidance: minimize internet exposure of control system devices, isolate them behind firewalls from business networks, and use secure remote access methods such as VPNs where necessary.
Mentioned in this report
Detection guidance
ZoneMinder Event Export Command Injection
Detects ZoneMinder web requests with shell metacharacters in the exportFile parameter, indicative of command injection attempts in the event export functionality. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: ZoneMinder Event Export Command Injection
description: Detects HTTP requests to ZoneMinder's event export functionality containing
shell metacharacters in the exportFile parameter, which may indicate command injection
exploitation of CVE-2026-76060.
tags:
- attack.execution
- attack.t1059.001
logsource:
category: web_application_firewall
product: zoneminder
detection:
selection:
http_uri|contains: export
http_method: POST
http_request_body|contains:
- exportFile=.*;
- exportFile=.*|
- exportFile=.*&
- exportFile=.*`
- exportFile=.*$((
- exportFile=.*$(\$
condition: selection
falsepositives:
- Legitimate file exports with special characters in filenames
- URL-encoded semicolons or pipes in legitimately named export files
level: high
id: f7fc0ae0-47ef-5c41-8fdd-17de52efb409
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-237-02
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free