PT-2026-51644 · Motioneye · Motioneye

Published 2026-06-23 · Updated 2026-06-24 · CVE-2026-55488

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions motionEye versions prior to 0.44.0

Description An absolute path traversal issue exists in multiple media file handlers within the media playback and download functionality. The affected handlers accept a user-controlled filename parameter and construct filesystem paths using the os.path.join() function. When an absolute path is provided, Python discards the configured media directory and returns the attacker-supplied path directly. The application further bypasses Tornado's built-in path validation by overriding safety checks in the get absolute path() and validate absolute path() functions. This allows an attacker to read arbitrary files from the filesystem that the motionEye process has permissions to access. The issue affects the following endpoints:

• '/movie//download/'
• '/picture//download/'
• '/picture//preview/'

Recommendations Update to version 0.44.0.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-55488

GHSA-RW9Q-97R9-8GVH

Affected Products

Motioneye

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-55488 · Security Note
• https://osv.dev/vulnerability/GHSA-rw9q-97r9-8gvh · Vendor Advisory
• https://github.com/motioneye-project/motioneye/security/advisories/GHSA-rw9q-97r9-8gvh · Note
• https://github.com/motioneye-project/motioneye · Note