CVE-2022-29806: Zoneminder

Critical severity, CVSS 9.8. EPSS: 67.1% chance of exploitation in the next 30 days.

ZoneMinder before 1.36.13 allows remote code execution via an invalid language. Ability to create a debug log file at an arbitrary pathname contributes to exploitability.

Affected products

• Zoneminder Zoneminder: before 1.36.13 (fixed in 1.36.13)

Published 2022-04-26. Last modified 2026-06-17.