Vulnerability · Published Aug 27, 2026 · Assigned by icscert
CVE-2026-76060OS Command Injection in PayRange API
High 8.8
In plain English
A high-severity OS command injection in Zoneminder from Zoneminder. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.4% (higher than 84% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HTTP request parameter is passed unsanitized into a shell command executed via PHP's exec(), allowing any authenticated user with View Events permission to execute arbitrary operating system commands on the server.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | zoneminder | no fix listed | DEBIAN-CVE-2026-76060 |
| Debian:13 | zoneminder | no fix listed | DEBIAN-CVE-2026-76060 |
| Debian:14 | zoneminder | no fix listed | DEBIAN-CVE-2026-76060 |
| Ubuntu:24.04:LTS | zoneminder | no fix listed | UBUNTU-CVE-2026-76060 |
| Ubuntu:26.04:LTS | zoneminder | no fix listed | UBUNTU-CVE-2026-76060 |
| Ubuntu:26.10 | zoneminder | no fix listed | UBUNTU-CVE-2026-76060 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Zoneminder | Zoneminder | 1.37.48 – before 1.38.3 |
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://zoneminder.com/downloads
- https://github.com/ZoneMinder/zoneminder
- https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-88m4-hrgp-m9v3
- https://www.cisa.gov/news-events/ics-advisories/icsa-26-237-02
- https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-237-02.json