CVE-2026-30971

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-30971
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-30971.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-30971
Aliases
  • GHSA-g66m-77fq-79v9
Downstream
Published
2026-10-16T19:40:51Z
Modified
2026-10-17T10:45:13Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
ZoneMinder: Authenticated RCE via command injection in monitor Device Path
Details

ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.39.2, 1.38.2, and 1.36.40, ZoneMinder interpolates an unvalidated monitor Device field into shell commands in PHP and Perl control paths when an authenticated user with monitor-create or monitor-edit permission saves a Local monitor whose Device Path contains shell metacharacters and the monitor control or startup path runs. In this attack mechanism, the stored Device value reaches Perl qx() and backtick execution before zmdc.pl argument detainting, while separate PHP command paths use bypassable escapeshellcmd defenses. The attacker can execute arbitrary commands as the web server user. This vulnerability is fixed in 1.39.2, 1.38.2, and 1.36.40.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-78"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30971.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "fixed":  "1.36.40"
                },
                {
                    "introduced":  "1.39.0"
                },
                {
                    "fixed":  "1.39.2"
                }
            ],
            "source":  "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/zoneminder/zoneminder

Affected ranges

Type
GIT
Repo
https://github.com/zoneminder/zoneminder
Events
Introduced
39c2cc997beb038aed2e7f17abf372ee3b32e090
Fixed
cd256117cf2f2d8fc62f202864a5a61172d34670
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "1.38.0"
        },
        {
            "fixed":  "1.38.2"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

1.*
1.38.0
1.38.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-30971.json"