PT-2025-45648 · Pypi · Motioneye

Publicado 2025-10-03 · Atualizado 2025-10-03

OSV

CVSS v3.1

7.2

Alta

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-j945-qm58-4gjx. This link is maintained to preserve external references.

Original Description

MotionEye v0.43.1b4 and before is vulnerable to OS Command Injection in configuration parameters such as image file name. Unsanitized user input is written to Motion configuration files, allowing remote authenticated attackers with admin access to achieve code execution when Motion is restarted.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

GHSA-26F6-WM47-7H7J

Produtos afetados

Motioneye

Referências · 4

• https://osv.dev/vulnerability/GHSA-26f6-wm47-7h7j · Aviso do Fabricante
• http://motioneye-project.com · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-60787 · Nota de Segurança
• https://github.com/prabhatverma47/motionEye-RCE-through-config-parameter · Nota