CVE-2026-76060

Name of the Vulnerable Software and Affected Versions ZoneMinder (affected versions not specified)

Description An authenticated OS command injection issue exists in the event export functionality. An authenticated user with View Events permission can execute arbitrary operating system commands on the server because the exportFile parameter in the HTTP request is passed unsanitized into a shell command executed via the exec() function. Real-world incidents have been observed where attackers exploited this flaw to achieve remote code execution and perform lateral movement to connected infrastructure.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.