CVE-2026-102608Published
ZoneMinder: Authenticated OS Command Injection via unsanitized Monitor Name in event export (download_functions.php)
Exact source revision recorded 23 Oct 2026 15:48:27 UTC. It does not establish the source's current position. Latest evidence.
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-102608 · Microsoft / collected KEV context
cve-program · CVE-2026-102608
- https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-88m4-hrgp-m9v3
- https://github.com/ZoneMinder/zoneminder/commit/2de2ae44a1d751bad4b020c5573b2d58c59c1525
- https://github.com/ZoneMinder/zoneminder/commit/b3a7c05f079c87badf4b0ce052da0acfd4047a4b
- https://github.com/ZoneMinder/zoneminder/commit/b5605e01c14354fc8e2dcae8cefd90c3674880d9
- https://github.com/ZoneMinder/zoneminder/releases/tag/1.38.3
- https://www.scriptkittens.com/blog/two-sinks-one-shell
Current operational correlations are not mixed into this historical source record. Open latest evidence to discover current connections.