CVE-2026-67827

Name of the Vulnerable Software and Affected Versions ZLMediaKit versions prior to commit 9fd5152

Description Incorrect access control in the HTTP API module allows unauthenticated remote attackers to achieve Remote Code Execution (RCE). An attacker can access the 'setServerConfig' API endpoint to overwrite the ffmpeg.snap configuration parameter with arbitrary shell commands. These commands are then executed with the privileges of the ZLMediaKit process when the 'getSnap' API endpoint is called.

Recommendations Update ZLMediaKit to a version containing commit 9fd5152 or later. Restrict access to the 'setServerConfig' and 'getSnap' API endpoints to prevent unauthorized configuration changes.