Critical severity · published Feb 25, 2023
CVE-2023-26036
ZoneMinder contains Local File Inclusion vulnerability
9.8
CVSS
0.9%
EPSS
No
On KEV
Description
ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 and 1.37.33 contain a Local File Inclusion (Untrusted Search Path) vulnerability via /web/index.php. By controlling $view, any local file ending in .php can be executed. This is supposed to be mitigated by calling detaintPath, however dentaintPath does not properly sandbox the path. This can be exploited by constructing paths like "..././", which get replaced by "../". This issue is patched in versions 1.36.33 and 1.37.33.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 60% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ZO
zoneminder · ZoneMinder
< 1.36.33; >= 1.37.0, < 1.37.33 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-26036
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-26036
Exploit
https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-h5m9-6jjc-cgmw
More from zoneminder
9.9
CVE-2024-51482
Boolean-based SQL Injection in ZoneMinder v1.37.* <= 1.37.64
9.8
CVE-2025-65791
ZoneMinder v1.36.34 is vulnerable to Command Injection in web/views/image.php
9.8
CVE-2024-43360
ZoneMinder Time-based SQL Injection
9.8
CVE-2023-26037
ZoneMinder contains SQL Injection via report_event_audit
9.8
CVE-2023-26035
ZoneMinder vulnerable to Missing Authorization