motionEye vulnerable to RCE in add_camera Function Due to unsafe command execution
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-78.
Summary
motionEye is an online interface for the software motion, a video surveillance program with motion detection. In versions 0.43.1b1 through 0.43.1b3, using a constructed (camera) device path with the `add`/`add_camera` motionEye web API allows an attacker with motionEye admin user credentials to execute any command within a non-interactive shell as motionEye run user, `motion` by default. The vulnerability has been patched with motionEye v0.43.1b4. As a workaround, apply the patch manually.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| motioneye-project | motioneye | 0.43.1b1 to before 0.43.1b4 | 0.43.1b4 | Patch available | CNA |
| — | motioneye (PyPI) | 0.43.1b1 to before 0.43.1b4 | 0.43.1b4 | Patch available | GHSA-g5mq-prx7-c588 |
- motioneye Vendormotioneye-project Affected 0.43.1b1 to before 0.43.1b4 Fixed in 0.43.1b4 Patch available CNA
- motioneye (PyPI) Vendor— Affected 0.43.1b1 to before 0.43.1b4 Fixed in 0.43.1b4 Patch available GHSA-g5mq-prx7-c588
Remediation
- Fix · CNA motioneye (motioneye-project) Fixed in 0.43.1b4
- Fix · GHSA-g5mq-prx7-c588 motioneye (PyPI) Fixed in 0.43.1b4 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2025-47782
- 2026-10-03 Alias added: GHSA-g5mq-prx7-c588
References
Other 5
- https://github.com/motioneye-project/motioneye/security/advisories/GHSA-g5mq-prx7-c588
- https://github.com/motioneye-project/motioneye/issues/3142
- https://github.com/motioneye-project/motioneye/pull/3143
- https://github.com/motioneye-project/motioneye
- https://github.com/pypa/advisory-database/tree/main/vulns/motioneye/PYSEC-2025-39.yaml
More motioneye-project vulnerabilities
- TI-2026-34187 motionEye: Authentication possible via password hash CVSS 4.0CRITICAL 9.1
- TI-2026-40043 motionEye's Absolute Path Traversal in Media File Handlers Allows Arbitrary File Read CVSS 4.0HIGH 7.7
- TI-2025-37818 MotionEye v0.43.1b4 and before is vulnerable to OS Command Injection in configuration… CVSS 3.1HIGH 7.2
- TI-2026-40322 motionEye: Missing authentication on ActionHandler allows unauthenticated camera action execution CVSS 3.1MEDIUM 5.3
- TI-2026-24521 motionEye: Arbitrary File Read via Path Traversal in Picture/Movie Preview Endpoint CVSS 3.1MEDIUM 6.5
- TI-2026-24843 motionEye: World-Readable Configuration File Exposes Admin Password Hash CVSS 3.1MEDIUM 5.5
Sources
- CVE-2025-47782 · CVE Program
- CVE-2025-47782 · NVD
- FIRST EPSS
- GHSA-g5mq-prx7-c588 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences