CVE-2024-58386: Zoneminder

Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days.

ZoneMinder versions 1.37.0 before 1.38.0 contain a path traversal vulnerability in the files view that allows authenticated users to read arbitrary files. The path parameter is not properly validated before being passed to output_file, enabling attackers with Events view permission to access sensitive files like configuration files containing database credentials.

Affected products

• Zoneminder Zoneminder: from 1.37.0, before 1.38.0 (fixed in 1.38.0)

Published 2026-09-28. Last modified 2026-09-30.