PT-2026-51430 · Motioneye · Motioneye

Published 2026-06-22 · Updated 2026-06-23 · CVE-2026-31978

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions motionEye version 0.43.1

Description An absolute path traversal issue exists in the picture and movie API endpoints, such as '/picture/{id}/preview/{filename}'. The vulnerability occurs because the API handlers and functions get media preview() and del media content() in mediafiles.py do not validate the filename parameter for .. sequences. This allows an authenticated user with normal privileges to read arbitrary files from the filesystem as the motionEye process user. The exploitation requires the use of %2F-encoded slashes, which are passed raw to os.path.join() by the Tornado URL router.

Recommendations As a temporary workaround, restrict access to the '/picture/{id}/preview/{filename}' API endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Path traversal

Weakness Enumeration

CWE-284

CWE-22

Related Identifiers

CVE-2026-31978

GHSA-G9FX-5R4H-PCW3

Affected Products

Motioneye

References · 6

• https://osv.dev/vulnerability/GHSA-g9fx-5r4h-pcw3 · Vendor Advisory
• https://github.com/motioneye-project/motioneye/security/advisories/GHSA-g9fx-5r4h-pcw3 · Note
• https://github.com/motioneye-project/motioneye · Note
• https://twitter.com/dailycve/status/2069508037975421308 · Twitter Post
• https://twitter.com/dailycve/status/2069512459841417605 · Twitter Post
• https://twitter.com/dailycve/status/2069508233383874956 · Twitter Post