CVE-2026-76060
OS Command Injection in PayRange API
- Published
- Last modified
- Status
- published
- Known exploitation
- Not listed in CISA KEV
- Fix
- Fixed in 1.38.3
- Public exploit
- None on Exploit-DB
Summary
An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HTTP request parameter is passed unsanitized into a shell command executed via PHP's exec(), allowing any authenticated user with View Events permission to execute arbitrary operating system commands on the server.
Affected versions
- Zoneminder Zoneminder
From 1.37.48 · fixed in 1.38.3