CVE details
CVE-2024-58386
ZoneMinder versions 1.37.0 before 1.38.0 contain a path traversal vulnerability in the files view that allows authenticated users to read arbitrary files. The path parameter is not properly validated before being passed to output_file, enabling attackers with Events view permission to access sensitive files like configuration files containing database credentials.
- Score
- 7.1 high
- Published
- 2026-09-28
- Links
- NVD · cve.org · Report wrong data
Matched ports (4)
| Port | Package | Version | Status | Maintainer |
|---|---|---|---|---|
| multimedia/zoneminder | zoneminder-php82 | 1.38.6 | fixed by update | bsd@abinet.ru |
| multimedia/zoneminder | zoneminder-php83 | 1.38.6 | fixed by update | bsd@abinet.ru |
| multimedia/zoneminder | zoneminder-php84 | 1.38.6 | fixed by update | bsd@abinet.ru |
| multimedia/zoneminder | zoneminder-php85 | 1.38.6 | fixed by update | bsd@abinet.ru |