CVE-2023-26038

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 and 1.37.33 contain a Local File Inclusion (Untrusted Search Path) vulnerability via web/ajax/modal.php, where an arbitrary php file path can be passed in the request and loaded. This issue is patched in versions 1.36.33 and 1.37.33.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-426

Affected software

Vendor	Product	Versions
ZoneMinder	zoneminder	< 1.36.33; >= 1.37.0, < 1.37.33

References

https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-wrx3-r8c4-r24wExploit, Patch, Vendor Advisory
https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-wrx3-r8c4-r24wExploit, Patch, Vendor Advisory

Timeline

Published: Feb 25, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-260398.8ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versio CVE-2023-26046.1The Team Circle Image Slider With Lightbox plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘search_term’ parame CVE-2023-260406.1Discourse is an open-source discussion platform. Between versions 3.1.0.beta2 and 3.1.0.beta3 of the `tests-passed` branch, editing or respo CVE-2023-260414.3Nextcloud Talk is a fully on-premises audio/video and chat communication service. When cron jobs were misconfigured and therefore messages a CVE-2023-260426.1Part-DB is an open source inventory management system for your electronic components. User input was found not being properly escaped, which CVE-2023-260436.5GeoNode is an open source platform that facilitates the creation, sharing, and collaborative use of geospatial data. GeoNode is vulnerable t CVE-2023-260445.3react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP. Previous versions of ReactPHP's HTTP server co CVE-2023-260459.8NodeBB is Node.js based forum software. Starting in version 2.5.0 and prior to version 2.8.7, due to the use of the object destructuring ass CVE-2023-260466.1teler-waf is a Go HTTP middleware that provides teler IDS functionality to protect against web-based attacks. In teler-waf prior to version CVE-2023-260476.1teler-waf is a Go HTTP middleware that provides teler IDS functionality to protect against web-based attacks. In teler-waf prior to version CVE-2023-260485.3Jetty is a java based web server and servlet engine. In affected versions servlets with multipart support (e.g. annotated with `@MultipartCo CVE-2023-260495.3Jetty is a java based web server and servlet engine. Nonstandard cookie parsing in Jetty may allow an attacker to smuggle cookies within oth