MotionEye v0.43.1b4 and before is vulnerable to OS Command Injection in configuration…
Priority HIGH 67CWE-116Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-78.
Summary
MotionEye v0.43.1b4 and before is vulnerable to OS Command Injection in configuration parameters such as image_file_name. Unsanitized user input is written to Motion configuration files, allowing remote authenticated attackers with admin access to achieve code execution when Motion is restarted.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.18462 97th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed motioneye (PyPI): 0.43.1b5
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | motioneye (PyPI) | before 0.43.1b5 | 0.43.1b5 | Patch available | GHSA-j945-qm58-4gjx |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- motioneye (PyPI) Vendor— Affected before 0.43.1b5 Fixed in 0.43.1b5 Patch available GHSA-j945-qm58-4gjx
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:motioneye_project:motioneye:0.42.1:*:*:*:*:*:*:* | 0.42.1 | Vulnerable | motioneye-project |
| cpe:2.3:a:motioneye_project:motioneye:0.43.1:beta1:*:*:*:*:*:* | 0.43.1 beta1 | Vulnerable | motioneye-project |
| cpe:2.3:a:motioneye_project:motioneye:0.43.1:beta2:*:*:*:*:*:* | 0.43.1 beta2 | Vulnerable | motioneye-project |
| cpe:2.3:a:motioneye_project:motioneye:0.43.1:beta3:*:*:*:*:*:* | 0.43.1 beta3 | Vulnerable | motioneye-project |
| cpe:2.3:a:motioneye_project:motioneye:0.43.1:beta4:*:*:*:*:*:* | 0.43.1 beta4 | Vulnerable | motioneye-project |
- cpe:2.3:a:motioneye_project:motioneye:0.42.1:*:*:*:*:*:*:* Versions 0.42.1 Vulnerable ·motioneye-project
- cpe:2.3:a:motioneye_project:motioneye:0.43.1:beta1:*:*:*:*:*:* Versions 0.43.1 beta1 Vulnerable ·motioneye-project
- cpe:2.3:a:motioneye_project:motioneye:0.43.1:beta2:*:*:*:*:*:* Versions 0.43.1 beta2 Vulnerable ·motioneye-project
- cpe:2.3:a:motioneye_project:motioneye:0.43.1:beta3:*:*:*:*:*:* Versions 0.43.1 beta3 Vulnerable ·motioneye-project
- cpe:2.3:a:motioneye_project:motioneye:0.43.1:beta4:*:*:*:*:*:* Versions 0.43.1 beta4 Vulnerable ·motioneye-project
Remediation
- Fix · GHSA-j945-qm58-4gjx motioneye (PyPI) Fixed in 0.43.1b5 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2025-60787
- 2026-10-03 Alias added: GHSA-j945-qm58-4gjx
References
More motioneye-project Motioneye vulnerabilities
- TI-2022-09169 MotionEye v0.42.1 and below allows attackers to access sensitive information via a GET… CVSS 3.1HIGH 7.5
- TI-2021-19932 Authenticated remote code execution in MotionEye <= 0.42.1 and MotioneEyeOS <= 20200606… CVSS 3.1HIGH 7.2
Sources
- CVE-2025-60787 · CVE Program
- CVE-2025-60787 · NVD
- FIRST EPSS
- GHSA-j945-qm58-4gjx · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences