An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HTTP request parameter is passed unsanitized into a shell command executed via PHP's exec(), allowing any authenticated user with View Events permission to execute arbitrary operating system commands on the server.

CVE-2026-76060 describes an authenticated OS command injection vulnerability in ZoneMinder's event export functionality. The exportFile HTTP request parameter is passed unsanitized into a shell command executed through PHP's exec() function. Any authenticated user holding the View Events permission can exploit this flaw to execute arbitrary operating system commands on the server. The vulnerability resides in ZoneMinder, an open-source video surveillance platform. A CISA ICS advisory (ICSA-26-237-02) has been issued in relation to this vulnerability, indicating potential impact on operational technology environments. No mention of active exploitation is made, but the low privilege requirement (authenticated user with basic permissions) raises the risk level significantly. A GitHub security advisory (GHSA-88m4-hrgp-m9v3) has also been published. Users are advised to apply patches available via ZoneMinder's official downloads page.