Command Injection Vulnerability in ZoneMinder by ZoneMinder Team
CVE-2025-65791

9.8CRITICAL

Key Information:

Vendor

ZoneMinder Team

Status
ZoneMinder
Vendor
CVE Published:
18 February 2026

What is CVE-2025-65791?

ZoneMinder version 1.36.34 contains a command injection vulnerability within the web/views/image.php component. This security flaw occurs because the application processes unsanitized user input through the exec() function, allowing attackers to execute arbitrary commands on the server. Successful exploitation of this vulnerability may lead to unauthorized access or control over the affected system.

References

https://github.com/rishavand1/CVE-2025-65791

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.