CVE-2023-26038

ZoneMinder contains Local File Inclusion vulnerability via `web/ajax/modal.php`

State: Published
Severity: 5.4 Medium
Published: Feb 25, 2023
Updated: Mar 10, 2025
Reserved: Feb 17, 2023

Description

ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 and 1.37.33 contain a Local File Inclusion (Untrusted Search Path) vulnerability via web/ajax/modal.php, where an arbitrary php file path can be passed in the request and loaded. This issue is patched in versions 1.36.33 and 1.37.33.

Scores

CVSS	Score	Vector	Source
3.1	5.4 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N	GitHub_M

Weaknesses

CWE-426 Untrusted Search Path

Affected Products

Product	Versions
zoneminderZoneMinder	< 1.36.33Affected >= 1.37.0, < 1.37.33Affected

References

https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-wrx3-r8c4-r24w

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.