Prior to 1.38.3, downloadEvents() manually wraps a monitor Name value in single quotes instead of using escapeshellarg() before placing it in shell… (CVE-2026-102608)

ZoneMinder before version 1.38.3 has a command injection vulnerability (CVE-2026-102608) in the downloadEvents() function. The vulnerability arises because the monitor Name value is manually wrapped in single quotes rather than properly escaped using escapeshellarg() before being incorporated into shell commands. This flaw allows an attacker who can create or edit monitors to inject shell metacharacters into the monitor Name. When a user with Events View permission exports events for that monitor, the crafted Name value is passed to both ffmpeg concatenation and archive commands (tar or zip), breaking out of the manual quoting and enabling arbitrary command execution with the privileges of the web server user. The vulnerability is addressed in ZoneMinder version 1.38.3.

Successful exploitation allows an attacker with limited permissions (monitor-create or monitor-edit) to execute arbitrary shell commands as the web server user when another user with Events View permission exports events. This can lead to full compromise of the web server environment, including confidentiality, integrity, and availability impacts as indicated by the CVSS score of 9.0 (critical).

Upgrade ZoneMinder to version 1.38.3 or later, where this vulnerability is fixed by properly escaping shell arguments. Until upgrading, restrict monitor-create and monitor-edit permissions to trusted users only to reduce risk. No other official fixes or temporary mitigations are documented.