PyPI: motioneye
CVE-2025-60787
Safety vulnerability ID: SFTY-20251103-96930
Safety legacy ID: pyup.io-81064
Affected versions of the motioneye package are vulnerable to Command Injection due to unsanitized filename configuration fields being written into Motion configuration files and later interpreted by the Motion process. The Web UI’s image_file_name and movie_filename fields are persisted by ConfigHandler.set_config() via config.py into /etc/motioneye/camera-*.conf, and when motionctl.restart() reloads Motion, shell metacharacters (for example $() or backticks) in those values are executed because they are treated as shell-expandable strings.
Overview
motionEye vulnerable to RCE via unsanitized motion config parameter
Advisory
Affected versions of the motioneye package are vulnerable to Command Injection due to unsanitized filename configuration fields being written into Motion configuration files and later interpreted by the Motion process. The Web UI’s image_file_name and movie_filename fields are persisted by ConfigHandler.set_config() via config.py into /etc/motioneye/camera-*.conf, and when motionctl.restart() reloads Motion, shell metacharacters (for example $() or backticks) in those values are executed because they are treated as shell-expandable strings.
How to Fix
Mitigation and Workarounds
---
Vulnerable Functions
Functions linked to known vulnerabilities.
References
- https://getsafety.com/vulnerabilities/SFTY-20251103-96930/CVE-2025-60787
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-60787
- https://data.safetycli.com/changelogs/motioneye/
- https://github.com/advisories/GHSA-j945-qm58-4gjx
- https://pypi.org/project/motioneye
- https://github.com/motioneye-project/motioneye/security/advisories/GHSA-j945-qm58-4gjx
- https://nvd.nist.gov/vuln/detail/CVE-2025-60787
- https://github.com/prabhatverma47/motionEye-RCE-through-config-parameter
- https://github.com/advisories/GHSA-j945-qm58-4gjx
Verified by Safety
Our Cybersecurity Intelligence Team reviewed this vulnerability. We combine public data with our own research to find issues not yet reported to public sources.
Learn more