PT-2025-45648 · Pypi · Motioneye

Published 2025-10-03 · Updated 2025-10-03

OSV

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-j945-qm58-4gjx. This link is maintained to preserve external references.

Original Description

MotionEye v0.43.1b4 and before is vulnerable to OS Command Injection in configuration parameters such as image file name. Unsanitized user input is written to Motion configuration files, allowing remote authenticated attackers with admin access to achieve code execution when Motion is restarted.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

GHSA-26F6-WM47-7H7J

Affected Products

Motioneye

References · 4

• https://osv.dev/vulnerability/GHSA-26f6-wm47-7h7j · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-60787 · Security Note
• http://motioneye-project.com · Note
• https://github.com/prabhatverma47/motionEye-RCE-through-config-parameter · Note