CVE-2024-58386 — ZoneMinder 1.37.x Path Traversal via files view
ZoneMinder versions 1.37.0 before 1.38.0 contain a path traversal vulnerability in the files view that allows authenticated users to read arbitrary files. The path parameter is …
Published: 2026-09-28 · CVSS: 7.1 · CVSS 4.0
ZoneMinder versions 1.37.0 before 1.38.0 contain a path traversal vulnerability in the files view that allows authenticated users to read arbitrary files. The path parameter is not properly validated before being passed to output_file, enabling attackers with Events view permission to access sensitive files like configuration files containing database credentials.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7