CVE-2026-72556 — ZoneMinder ZoneMinder - Remote Code Execution
A remote code execution vulnerability in ZoneMinder 1.39.17 allows any authenticated user to execute OS commands by exploiting a broken permission check in the Filter class. The…
Published: 2026-08-11 · CVSS: 8.8 · CVSS 3.1
A remote code execution vulnerability in ZoneMinder 1.39.17 allows any authenticated user to execute OS commands by exploiting a broken permission check in the Filter class. The canEdit() and canDelete() methods invoke nonexistent methods on the ZM\User class, causing PHP __call() to return a truthy value that bypasses the permission check for all users. Any authenticated user can trigger filter-based OS command execution regardless of their assigned role.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7