CVE and update status of the FreeBSD ports tree3,298 unaddressed CVEs in 671 portsAll times are CET
Port details

multimedia/zoneminder 1.38.6

Complete security camera solution, fully web based with image analysis

Port info

Maintainer
bsd@abinet.ru
Packages
latest: zoneminder-php82 1.38.6, zoneminder-php83 1.38.6, zoneminder-php84 1.38.6, zoneminder-php85 1.38.6
Upstream
up to date
Last update
to 1.38.6 · abb6f898c0
Quarterly
2026Q4: zoneminder-php82 1.38.6, zoneminder-php83 1.38.6, zoneminder-php84 1.38.6, zoneminder-php85 1.38.6 · last MFH 3849408b31
WWW
https://www.zoneminder.com/
Links
cgit · VuXML · Report wrong data

Install

Package
# pkg install zoneminder-php82
# pkg install zoneminder-php83
# pkg install zoneminder-php84
# pkg install zoneminder-php85
installs zoneminder-php82 1.38.6, zoneminder-php83 1.38.6, zoneminder-php84 1.38.6, zoneminder-php85 1.38.6 from latest; from quarterly (2026Q4) zoneminder-php82 1.38.6, zoneminder-php83 1.38.6, zoneminder-php84 1.38.6, zoneminder-php85 1.38.6
Port
# cd /usr/ports/multimedia/zoneminder && make install clean
# make -C /usr/ports/multimedia/zoneminder config  # change options first
Size
10.0 MiB download · 57 MiB installed
Depends on
archivers/zip 3.0_6, comms/p5-Device-SerialPort 1.040000_2, converters/p5-JSON-MaybeXS 1.004008, databases/mysql84-client 8.4.11_1, databases/p5-DBD-mysql 5.008, databases/p5-DBI 1.656, databases/php82-pdo_mysql 8.2.35_2, devel/libunwind 20250904, devel/p5-Data-Dump 1.25, devel/p5-Data-UUID 1.227, devel/p5-Date-Manip 7.00, devel/p5-Number-Bytes-Human 0.11_2, devel/p5-SOAP-WSDL 3.004_1, devel/p5-Sys-CPU 0.61, devel/p5-Sys-MemInfo 0.99, devel/p5-Sys-Mmap 0.21, devel/pecl-APCu 5.1.28, devel/php82-intl 8.2.35_2, devel/php82-sysvsem 8.2.35_2, ftp/curl 8.23.0, graphics/jpeg-turbo 3.1.4.1, graphics/php82-gd 8.2.35_2, lang/perl5.42 5.42.3, lang/php82 8.2.35_2, multimedia/ffmpeg 9.0.2_2,1, net/p5-IO-Socket-Multicast 1.12_2, net/php82-sockets 8.2.35_2, security/p5-Bytes-Random-Secure 0.29, security/p5-Crypt-Eksblowfish 0.009_3, security/sudo 1.9.17p2_2, textproc/p5-XML-LibXML 2.0213,1, textproc/php82-ctype 8.2.35_2, www/p5-LWP-Protocol-https 6.17, www/p5-Test-LWP-UserAgent 0.036, www/php82-opcache 8.2.35_2, www/php82-session 8.2.35_2
License
GPLv2
Options
1 of 2 on in the package: NLS
Show the 1 options that are off
V4L
pkg-message
Shown after installing
ZoneMinder requires a MySQL (or MySQL forks) database backend and 
a http server, capable to execute PHP and CGI scripts.

To simplify things, we assume, that you use MySQL and NGINX on 
the same server.

1. Preliminary steps

1.1 Install databases/mysql57-server or newer
	You may choose your favourite method - ports or packages here. 

	ZoneMinder use very simple queries, however it tends to write to 
	the database quite a lot depending on your capture mode and number 
	of cameras. So tweak your MySQL instance accordantly

	Now, enable and start MySQL
		sysrc mysql_server_enable="YES"
		service mysql-server start

1.2 Install www/nginx 
	We provide an example for an HTTP install, however, you should use 
	HTTPS if you plan to expose your installation to the public. There 
	are plenty guides how to do it and security/letsencrypt.sh is a 
	good way to get a valid SSL certificate. Probably, your installation
	will be behind reverse proxy, so this example should work for you.

	Please, notive the following issues with ZM:

	- web interface has several hardcoded /zm in url generation, so it is
		mandatory to serve your installtion from /zm subfolder
	- if behind reverse proxy, HTTP_X_FORWARDED_PROTO must be supplied or link
		generation will use http://

	Your server block should include the following:

	server {
		listen 80;

		root /usr/local/www/zoneminder;
		index index.php
		gzip off;

		location /cgi-bin/nph-zms {

			include fastcgi_params;
			fastcgi_param SCRIPT_FILENAME $request_filename;
			fastcgi_pass  unix:/var/run/fcgiwrap/fcgiwrap.sock;
		}

		location /zm/cache {

			alias /var/cache/zoneminder;
		}

		location /zm {

			alias	/usr/local/www/zoneminder;

			location ~ \.php$ {

				if (!-f $request_filename) { return 404; }
				include fastcgi_params;
				fastcgi_param SCRIPT_FILENAME $request_filename;
				fastcgi_index index.php;
				fastcgi_pass unix:/var/run/php-fpm.sock;
			}

			location ~ \.(jpg|jpeg|gif|png|ico)$ {
				access_log	off;
				expires	33d;
			}

			location /zm/api/ {
				alias	/usr/local/www/zoneminder;
				rewrite ^/zm/api(.+)$ /zm/api/app/webroot/index.php?p=$1 last;
			}
		}
	}

	Enable and start NGINX
		sysrc nginx_enable="YES"
		service nginx start

1.3 Install www/fcgiwrap 
	As NGINX lacks it's own CGI wrapper, we need external one. Please 
	note that ZoneMinder's montage page use simultaneous access to all 
	cameras, so you need to use at least as many fcgiwrap workers as 
	your number of cameras. The following example assumes you have 4.

	Enable and start FcgiWrap
		sysrc fcgiwrap_enable="YES"
		sysrc fcgiwrap_user="www"
		sysrc fcgiwrap_socket_owner="www"
		sysrc fcgiwrap_flags="-c 4"

1.4 PHP is installed as a dependency to ZoneMinder. However, you should 
	tweak some of it's settings.
	Edit /usr/local/etc/php-fpm.conf and set

		listen = /var/run/php-fpm.sock
		listen.owner = www
		listen.group = www
		env[PATH] = /usr/local/bin:/usr/bin:/bin

	If you want to set another path for the socket file, make sure you 
	change it in your NGINX config well. The env[PATH] needs to be set 
	to locate the zip utility as ZoneMinder's export functions rely on 
	exec(). Sorry, chroot folks. 

	PHP throws warning if date.timezone option is not set. The best place 
	to do it is to create new ini file in /usr/local/etc/php with overrides

		date.timezone = "UTC"

	Enable and start php-fpm
		sysrc php_fpm_enable="YES"
		service php-fpm start

1.5 ZoneMinder keeps the last 1-3 frames from monitors as cache when broadcasting 
        stream through zms. This can be a performance hog if 
	placed on spindle drive or add wear to SSD. The best practice is put it on 
	tmpfs. 	See https://www.freebsd.org/cgi/man.cgi?query=tmpfs for more 
	information.

	ZoneMinder will use /tmp for default. If you plan to change it, see 
	ZM_PATH_MAP setting.

	Edit /etc/fstab and add the following:

		tmpfs			/tmp		tmpfs	rw,nosuid,mode=01777	0	0

2. ZoneMinder installation

	Connect to MySQL under root and create zm user and populate database.

	mysql -u root -p
	
		CREATE DATABASE zm;
		GRANT ALL PRIVILEGES ON zm.* TO 'zmuser'@'localhost' IDENTIFIED BY 'zmpass';
		FLUSH PRIVILEGES;
		quit;
	
	mysql -u root -p zm < /usr/local/share/zoneminder/db/zm_create.sql
	
2.1 If you have chosen to change the ZoneMinder MySQL credentials to something
	other than zmuser/zmpass then you must now edit /usr/local/etc/zm.conf. Change
	ZM_DB_USER and ZM_DB_PASS to the values you created in the previous step.

	Enable and start ZoneMinder
		sysrc zoneminder_enable="YES"
		service zoneminder start
Shown after upgrading
To perform an upgrade from any version:
 
1. Stop ZoneMinder
	service zoneminder stop

2. Upgrade database
	sudo -u www zmupdate.pl
	
3. Start ZoneMinder
	service zoneminder start

If you see error ERROR 1419 (HY000) during database update, set 
log_bin_trust_function_creators = 1 in runtime or in mysql server config;

For example, login as root and issue SET GLOBAL log_bin_trust_function_creators = 1;

If ZM interface complains about absent configuration parameters, zmupdate.pl script
contains --freshen option to add them.

You can execute it with sudo -u www zmupdate.pl --freshen

Starting from version 1.36, ZM doesn't need too much tmpfs space. zmc process now
allocates memory as needed. tmpfs backed /tmp is still needed by zms to store 
1-3 images, so you shrink your tmpfs /tmp drasticallyi (if you followed installation
guide).
Note
Size, dependencies, options and messages are those of zoneminder-php82.

Packages by version and architecture

latest

FreeBSD versionamd64aarch64i386
FreeBSD 161.38.61.38.6–
FreeBSD 151.38.61.38.6–
FreeBSD 141.38.61.38.3✗

quarterly (2026Q4)

FreeBSD versionamd64aarch64i386
FreeBSD 151.38.61.38.6–
FreeBSD 141.38.61.38.6✗

version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.

Unaddressed (1)

The CVE record lists the packaged version 1.38.6 as affected, and no VuXML entry names the CVE. What does this mean?

CVECVSSPublishedDescription
CVE-2026-725568.82026-08-11A remote code execution vulnerability in ZoneMinder 1.39.17 allows any authenticated user to execute OS commands by exploiting a broken permission check in the Filter cl…

VuXML only (0)

Listed in VuXML, the packaged version 1.38.6 is still in the affected range; pkg audit reports it. What does this mean?

None.

Fixed (5)

Show 5 fixed
VuXML entries whose affected range the packaged version has left, plus CVEs from the last 90 days that this version is already past (fixed by update).
CVECVSSPublishedDescription
CVE-2026-1026089.02026-10-16ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, downloadEvents() manually wraps a monitor Name value in single quotes …
CVE-2026-309718.82026-10-16ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.39.2, 1.38.2, and 1.36.40, ZoneMinder interpolates an unvalidated monitor De…
CVE-2026-1026078.82026-10-16ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, the exportEvents() function concatenates the attacker-controlled expor…
CVE-2024-583867.12026-09-28ZoneMinder versions 1.37.0 before 1.38.0 contain a path traversal vulnerability in the files view that allows authenticated users to read arbitrary files. The path param…
CVE-2026-542586.52026-09-11ZoneMinder is a free, open source closed-circuit television software application. Versions prior to 1.36.39, 1.38.4, and 1.39.11 allow an authenticated low-privileged us…

Problem reports (0) · open in Bugzilla, most recently changed first

None.

Commits (139)

William Grzybowski (wg) · 1.25.0_3
multimedia/zoneminder: link using ffmpeg0

- Link using ffmpeg0
ff634cadb5
Baptiste Daroussin (bapt) · 1.25.0_2
Add NO_STAGE all over the place in preparation for the staging support (cat: multimedia)
855fb638fb
Andrej Zverev (az) · 1.25.0_2
- convert to the new perl5 framework - convert USE_GMAKE to Uses

Approved by:	portmgr (bapt@, blanket)
e47ac01488
Andrej Zverev (az) · 1.25.0_2
- Fix port afrer recent perl upgrade
150bf38aca
Andrej Zverev (az) · 1.25.0_1
- Fix build with new site_perl

Submitted by:	olli hauer <ohauer@gmx.de>
124b00a56f
Florian Smeets (flo) · 1.25.0_1
Convert the remaining ports that depend on databases/p5-DBD-mysql${MYSQL_VER} to just depend on databases/p5-DBD-mysql as that will handle the MYSQL_VER magic.

This is required as only databases/p5-DBD-mysql supports mariadb-client and
the upcomming perconaXX-client.

Approved by:	portmgr (bapt)
Initial patches by:	pgollucci
303e871aaa
Martin Matuska (mm) · 1.25.0_1
Update PCRE to 8.32 Introduces the UTF-32 library pcre32 Bump PORTREVISION in dependent ports
b2c4fbb77a
Andrej Zverev (az) · 1.25.0
- Remove SITE_PERL from *_DEPENDS

Approved by: portmgr@ (bapt@)
541bb1b198
Jason Helfman (jgh) · 1.25.0
- Update to 1.25.0 - pass maintainerhship to submitter - broken on < 900000 - while here drop WWWDIR_REL in favor of WWWDIR and use PORTDOCS

PR:     ports/165211
Submitted by:	pakhom706@gmail.com
Feature safe:	yes
6c50cf32d8
Ashish SHUKLA (ashish) · 1.24.4_14
- Bump PORTREVISION to chase the update of multimedia/libvpx
97ddb4e13d
Martin Matuska (mm) · 1.24.4_13
Bump pcre library dependency due to 8.30 update
dbbf004162
Doug Barton (dougb) · 1.24.4_12
In the rc.d scripts, change assignments to rcvar to use the literal name_enable wherever possible, and ${name}_enable when it's not, to prepare for the demise of set_rcvar().

In cases where I had to hand-edit unusual instances also
modify formatting slightly to be more uniform (and in
some cases, correct). This includes adding some $FreeBSD$
tags, and most importantly moving rcvar= to right after
name= so it's clear that one is derived from the other.
83eb2c3700
Boris Samorodov (bsam) · 1.24.4_12
Return to the pool since I don't use and ENOTIME to maintain those ports.

Feature safe:	yes
df94860644
Chris Rees (crees) · 1.24.4_12
Make @dirrms conditional for %%DOCSDIR%% on NOPORTDOCS

PR:		ports/162136
Submitted by:	4720@hushmail.com
Approved by:	[no rejections from any maintainer within 14 days]
Feature safe:	yes
6ab02ccd5e
Boris Samorodov (bsam) · 1.24.4_12
. update RC script: create procedure zm_prestart() to detect when   mysqld may be used by zoneminder; . delete 10 seconds sleep; . bump PORTREVISION.

Submitted by:	dougb (thanks!)
1a59abafcf
Boris Samorodov (bsam) · 1.24.4_11
. rename rc script (zm.in -> zoneminder.in);  [1] . add a note to UPDATING; . bump PORTREVISION.

Suggested by:	dougb  [1]
3e03f2e8f0
Boris Samorodov (bsam) · 1.24.4_10
Rework rc script: . name="zoneminder"; . do load_rc_config at a proper location and remove a second one; . some whitespace refinement; . do a 10 seconds pause only at system startup. Do not bump PORTREVISION for now, it'll be done when the file is renamed.

Submitted by:	dougb
d7cb6eb71b
Boris Samorodov (bsam) · 1.24.4_10
. create status_cmd (rc.d script with option status should work now); . bump PORTREVISION.

Reported by:	achix (at zoneminder forum)
16b571fa3f
Boris Samorodov (bsam) · 1.24.4_9
Remove databases/php5-mysql from BUILD_DEPENDS since the dependency is already utilized by USE_PHP=mysql.
7d9f73b790
Boris Samorodov (bsam) · 1.24.4_9
Fix an error at I386: zmwatch[2429].ERR [Shared data size conflict in shared_data for monitor Monitor-1, expected 328, got 316]

The patch for i386 ($arch should be 32 here but perl uses 64 bit integer):
-----
-our $arch = int(3.2*length(~0));
+our $arch = 32;
-----

I'm not sure how to properly fix this. I'm all ears.

Suggested by:	Yury Bushmelev <jay4mail@gmail.com> (via e-mail)
62cf6454cf
Boris Samorodov (bsam) · 1.24.4_8
Remove two dependencies: . www/mod_perl2 from RUN_DEPENDS (currently port uses only PHP for web); . security/gnutls from BUILD_DEPENDS (the port is just fine with openssl   from the base system). Bump PORTREVISION.

Suggested by:	Yury Bushmelev <jay4mail@gmail.com> (via e-mail)
7d4db91a4d
Martin Matuska (mm) · 1.24.4_7
Bump due to ffmpeg update to 0.7.1
c86cd8cae2
Boris Samorodov (bsam) · 1.24.4_6
. ZM_V4L2 -> ZM_HAS_V4L2 (at monitorprobe.php);  [1] . == -> = (at configure);  [2] . bump PORTREVISION.

Reported by:	pointyhat (via pavmail)  [1]
Discussed at:	zoneminder forum  [1]
Based on:	patch by Pavel Timofeev <timp87@gmail.com>  [2]
f2a2d8856d
Boris Samorodov (bsam) · 1.24.4_5
. add faststart and faststop options to zmpkg script (this enables zoneminder   loading at system startup); . bump PORTREVISION.
067f9e6680
Boris Samorodov (bsam) · 1.24.4_4
Refine credits to achix.

Proposed by:	achix (full nickname, zoneminder forum)
7b3d362264
Boris Samorodov (bsam) · 1.24.4_4
Add credits to achix who wrote at least local fbsd camera code by 99,99%.

Discussed with:	achix (full nickname, zoneminder forum)
756de15166
Boris Samorodov (bsam) · 1.24.4_4
1. Add some PHP extensions which are needed at runtime:    . json;    . mysql;    . session. 2. Bump PORTREVISION.
f89480eef5
Boris Samorodov (bsam) · 1.24.4_3
. remove devel/p5-PHP-Serialization dependency (the code uses devel/php5-json);  [1] . bump PORTREVISION; . remove empty file from files/ by creating the former while pre-build.  [2]

Reported by:	Vladimir Pushkar <vladimir.pushkar@gmail.com> (via e-mail)  [1]
Suggested by:	wen (via e-mail)  [2]
9dbb3a3963
Boris Samorodov (bsam) · 1.24.4_2
1) The distfile was re-packaged. Changes:   [1]   . fix a typo at a debug message;   . the version ID of that file. 2) Bump PORTREVISION.

PR:		ports/157650  [1]
Submitted by:		Pavel Timofeev <timp87@gmail.com>  [1]
f5df5815ef
Roman Bogorodskiy (novel) · 1.24.4_1
Chase security/gnutls update and add an UPDATING entry.
207386f96a
Boris Samorodov (bsam) · 1.24.4
. update to version 1.24.4; changelog:   http://www.zoneminder.com/wiki/index.php/Change_History#Release_1.24.4_-_2011.2F05.2F30; . remove patches that were incorporated upstream; . add a patch to fix zm_stream.cpp (add one byte to the path length);  [1] . add one more site to MASTER_SITES.

Submitted by:	Vladimir Pushkar <vladimir.pushkar@gmail.com> (via email)  [1]
3e97341844
Wen Heping (wen) · 1.24.2_3
- Revert previous commit

Reported by:	bsam@ (maintainer)
a49dcfd292
Wen Heping (wen) · 1.24.2_3
- Remove zero size file

PR:		ports/157174
Submitted by:	Alex kozlov <spam@rm-rf.kiev.ua>
Approved by:	maintainer(implicit)
159eeb607e
Boris Samorodov (bsam) · 1.24.2_3
Add missing header file.

Note: do not bump PORTREVISION since absence of this file prevents
the port from installing (let alone packaging). Unfortunately both my
workstation and tinderbox have got the file while porting and testing...

Reported by:	Vladimir Pushkar <vladimir.pushkar@gmail.com> (by email)
5dca89aa5c
Boris Samorodov (bsam) · 1.24.2_3
. do not use hardcoded perl version at the pkg-plist file; . bump PORTREVISION.

Reported by:	Vladimir Pushkar <vladimir.pushkar@gmail.com> (via email)
f213e60164
Doug Barton (dougb) · 1.24.2_2
Remove zero-byte files
f6a6028050
Boris Samorodov (bsam) · 1.24.2_2
. fix plist (move hardcoded perl version to %%PERL_VERSION%%   and mach to %%PERL_ARCH%%); . bump PORTREVISION.

Spotted by:	pointyhat (via pavmail)
ce1d00d7b7
Boris Samorodov (bsam) · 1.24.2_1
. use mod_perl2 since apache20 is the default nowadays; . bump PORTREVISION.
d0d7631b15
Boris Samorodov (bsam) · 1.24.2
Zoneminder is an all-in-one GPL'd security and surveillance camera solution. Fully web-based system for viewing and analyzing security camera feeds.

WWW: http://www.zoneminder.com/
da9c4172df