CVE-2025-47782
motionEye vulnerable to RCE in add_camera Function Due to unsafe command execution
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
motionEye vulnerable to RCE in add_camera Function Due to unsafe command execution
motionEye is an online interface for the software motion, a video surveillance program with motion detection. In versions 0.43.1b1 through 0.43.1b3, using a constructed (camera) device path with the `add`/`add_camera` motionEye web API allows an attacker with motionEye admin user credentials to execute any command within a non-interactive shell as motionEye run user, `motion` by default. The vulnerability has been patched with motionEye v0.43.1b4. As a workaround, apply the patch manually.
Reserved 2025-05-09 | Published 2025-05-14 | Updated 2025-05-14 | Assigner GitHub_MCWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
github.com/...ioneye/security/advisories/GHSA-g5mq-prx7-c588
github.com/motioneye-project/motioneye/issues/3142
github.com/motioneye-project/motioneye/pull/3143
Support options
