CVE-2026-102608

Name of the Vulnerable Software and Affected Versions ZoneMinder versions prior to 1.38.3

Description The downloadEvents() function fails to properly sanitize the monitor Name value by manually wrapping it in single quotes instead of using escapeshellarg() before incorporating it into shell commands. This occurs when a user with monitor-create or monitor-edit permissions stores a monitor Name containing shell metacharacters, and a user with Events View permissions subsequently exports those events. The stored name is passed to the ffmpeg concatenation command and the tar or zip archive command, allowing an attacker to break out of the quoting and execute arbitrary commands as the web server user.

Recommendations Update to version 1.38.3.