CVE-2025-65791: 
NixOS vulnerability analysis and mitigation

CVE-2025-65791 is a command injection vulnerability in ZoneMinder v1.36.34, specifically in the web/views/image.php component, where unsanitized user input is passed directly to PHP's exec() function, potentially allowing remote attackers to execute arbitrary OS commands. It was discovered in 2025 and publicly disclosed on February 18, 2026. The vulnerability is classified under CWE-78 and carries a CVSS v3.1 base score of 9.8 (Critical) (Feedly, GitHub PoC). Note: The ZoneMinder supplier disputes this vulnerability, asserting that there is no unsanitized user input reaching web/views/image.php (Feedly).

The root cause is improper neutralization of special elements used in an OS command (CWE-78): parameters processed in web/views/image.php are allegedly passed without sanitization to PHP's exec() function, enabling injection of shell metacharacters. The attack vector is network-based, requires no authentication, no user interaction, and low attack complexity, making it trivially exploitable if the vulnerability is genuine. A published proof-of-concept demonstrates the technique using a crafted when parameter (e.g., ?when=now;id) to append arbitrary shell commands to the intended execution flow (GitHub PoC). The supplier disputes the finding, claiming user input does not reach the vulnerable code path in the affected version (Feedly).

If exploitable, successful exploitation would grant an unauthenticated remote attacker the ability to execute arbitrary OS commands on the ZoneMinder server with the privileges of the web service process. This could result in complete system compromise, including reading or modifying sensitive files (e.g., camera footage, credentials), installing malware or backdoors, establishing reverse shells, and using the compromised host as a pivot point for lateral movement within the network (GitHub PoC, Feedly).

A public proof-of-concept exploit is available on GitHub, published by the discoverer Rishav Anand (GitHub PoC). As of the available intelligence, there is no confirmed evidence of active in-the-wild exploitation, and no threat actor attribution has been reported. The EPSS score is approximately 0.87%, indicating a relatively low (but non-negligible) probability of exploitation in the near term (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Reconnaissance: Identify internet-facing ZoneMinder v1.36.34 instances using search engines like Shodan or Censys, or by fingerprinting the web interface version.
2. Locate the vulnerable endpoint: Navigate to the web/views/image.php endpoint on the target ZoneMinder installation.
3. Craft the malicious request: Append a shell metacharacter payload to the when parameter, e.g., ?when=now;id or ?when=now;whoami, to inject an arbitrary command after the intended command.
4. Execute arbitrary commands: Submit the crafted HTTP GET or POST request to the server; if the vulnerability is present and exploitable, the injected command executes on the underlying OS with web server privileges.
5. Establish persistence: Use the command execution to download a reverse shell payload (e.g., via curl or wget), establish a persistent backdoor, or exfiltrate sensitive data (GitHub PoC).

• Network: Unusual or unexpected outbound connections from the ZoneMinder server to external IPs; HTTP requests to web/views/image.php containing shell metacharacters (;, |, &&, `) in query parameters such as when.
• Logs: Web server access logs showing requests to image.php with encoded or plaintext shell command payloads in query strings; error logs reflecting unexpected command execution output.
• Process: Unexpected child processes spawned by the PHP/web server process (e.g., sh, bash, id, whoami, curl, wget, nc); reverse shell connections originating from the web service user.
• File System: New or modified files in the ZoneMinder web directory or /tmp; presence of web shells or unauthorized scripts; new cron jobs created under the web service account.

No official vendor patch has been released for this CVE as of the latest available information, and the ZoneMinder supplier disputes the vulnerability's validity (Feedly). As interim mitigations, administrators should restrict network access to ZoneMinder web interfaces using firewall rules, limiting exposure to trusted networks only. Input validation and sanitization should be enforced at the application and network perimeter levels; use of escapeshellarg() or escapeshellcmd() in PHP is recommended if modifying the source. Monitor image.php endpoints for anomalous request patterns and apply least-privilege principles to the web service account (GitHub PoC).

The vulnerability received coverage from The Hacker Wire and was noted in community vulnerability digests (The Hacker Wire). Social media discussion was observed on Bluesky and Mastodon/Infosec.exchange, with community members flagging the PoC availability. The supplier's dispute of the vulnerability has been noted in the CVE description, which may temper broader industry concern until independent verification is completed (Feedly).