{"metadata": {"vulnerability": "CVE-2026-102607", "count": 11, "kinds": {"milestone": 3, "sighting": 2, "kev": 0, "other": 6}}, "data": [{"timestamp": "2026-09-29T14:18:02.921Z", "date_only": false, "value": "2026-09-29T14:18:02.921Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-102607", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-16T19:29:58.131Z", "date_only": false, "value": "2026-10-16T19:29:58.131Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-102607", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-16T19:29:58.131Z", "date_only": false, "value": "2026-10-16T19:29:58.131Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-102607", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-16T19:36:09.851Z", "date_only": false, "value": "2026-10-16T19:36:09.851239Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117452267143866829", "record": "CVE-2026-102607", "field": "creation_timestamp", "uuid": "c0721d5c-b132-4b31-9571-39613b2ac210", "content": "CVE-2026-102607 ZoneMinder: Authenticated OS Command Injection (RCE) via Export Feature ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, the exportEvents() function concatenates the attacker-controlled exportFile request parameter into a shell command without neutralizing shell metacharacters when an authenticated user with View Events or View Snapshots permission submits an event export request with a crafted exportFile value, a valid CSRF token, and exportDetail enabled. The affected components are exportEvents(), exportFile, web/ajax/event.php, web/skins/classic/includes/export_functions.php. In this attack mechanism, the crafted exportFile value reaches the trailing directory argument of a tar or zip command executed by exec(). The attacker can execute arbitrary operating system commands as the web server user. This issue is fixed in version 1.38.3.\nhttps://www.cve.org/CVERecord?id=CVE-2026-102607https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-7j62-cjxp-3cj5https://github.com/ZoneMinder/zoneminder/commit/548ed87d47a49c17b4c842f6fee8a08660deb427https://github.com/ZoneMinder/zoneminder/commit/605f962b7b6ba7f5780b3e6715b5418b8b2addcahttps://github.com/ZoneMinder/zoneminder/releases/tag/1.38.3#ZoneMinder #zoneminder#CVE_2026_102607#bot", "url": "https://infosec.exchange/users/cve/statuses/117452267143866829"}, {"timestamp": "2026-10-16T20:17:17.097Z", "date_only": false, "value": "2026-10-16T20:17:17.097", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-102607", "record": "FKIE_CVE-2026-102607", "field": "published"}, {"timestamp": "2026-10-16T20:47:39.009Z", "date_only": false, "value": "2026-10-16T20:47:39.009820Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mxzh56r2x52g", "record": "CVE-2026-102607", "field": "creation_timestamp", "uuid": "6602805e-a3c4-4482-9d28-9df9288039f2", "content": "\ud83d\udfe0 CVE-2026-102607 - High (8.8)\n\nZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-102607/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "url": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mxzh56r2x52g"}, {"timestamp": "2026-10-19T14:25:03.645Z", "date_only": false, "value": "2026-10-19T14:25:03.645262Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-102607", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-19T14:25:03.645Z", "date_only": false, "value": "2026-10-19T14:25:03.645262Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-102607", "record": "FKIE_CVE-2026-102607", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-19T14:26:23.072Z", "date_only": false, "value": "2026-10-19T14:26:23.072Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-102607", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-19T14:26:23.072Z", "date_only": false, "value": "2026-10-19T14:26:23.072Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-102607", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-19T15:16:53.960Z", "date_only": false, "value": "2026-10-19T15:16:53.960", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-102607", "record": "FKIE_CVE-2026-102607", "field": "lastModified"}]}