EUVD-2026-38804
GHSA-rw9q-97r9-8gvh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach motionEye web port 8765
-
DeliveryRequest media handler with absolute path
-
Exploitos.path.join discards target_dir
-
ExecutionOverridden Tornado checks skip validation
-
PersistServer returns arbitrary file
-
ImpactDisclose config/secrets (motion.conf)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires sending an HTTP request to one of motionEye's media handlers (/movie/<id>/playback, /movie/<id>/download, /picture/<id>/download, /picture/<id>/preview) with the filename parameter set to an absolute filesystem path (e.g. //etc/motioneye/motion.conf); no '../' traversal sequences or special encoding are needed because os.path.join() honors the absolute path directly. A valid camera_id is required to route to a handler (the PoC uses 1). Limiting factors: files are only readable subject to the OS permissions of the motionEye process (a non-root deployment cannot read root-owned secrets), and although the CVSS vector states PR:N, deployments that enable motionEye's admin/normal-user authentication require valid credentials before the handler is reachable, reducing this to an authenticated read. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N, base 7.7) describes a network-reachable, low-complexity, unauthenticated read with high-confidentiality impact and no integrity or availability effect, consistent with the trivial single-request PoC. Exploit maturity is flagged Proof-of-Concept (E:P) and a working PoC is published in the GHSA advisory, so a usable exploit clearly exists; however there is no KEV listing and no EPSS score in the provided data, so active or widespread exploitation is not established. The key caveat is authentication: the vector asserts PR:N, but motionEye deployments frequently enable admin/normal-user passwords, in which case real-world exploitation would require valid credentials (effectively PR:L) - verify against the specific deployment's auth configuration. Net: a real, easily weaponized information-disclosure bug worth prompt patching, but its blast radius is bounded to file reads and limited by the OS permissions and authentication under which the motionEye process runs. |
| Exploit ScenarioDerived | An attacker who can reach the motionEye web port sends a single crafted request such as 'GET /movie/1/playback//etc/motioneye/motion.conf', causing the server to return the configuration file (which may contain credentials) instead of a camera recording. A public PoC for exactly this request is included in the vendor advisory, and the attack requires only network access and knowledge of a valid camera_id. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jun 24, 2026
Arbitrary file read in motionEye versions before 0.44.0 lets remote attackers retrieve any file readable by the motionEye process by supplying an absolute path to the media playback, download, and preview handlers. The flaw stems from os.path.join() discarding the configured media directory when given an absolute path, compounded by MoviePlaybackHandler deliberately overriding Tornado's StaticFileHandler path-safety checks. A proof-of-concept exists and the CVSS 4.0 exploit-maturity is rated Proof-of-Concept, but there is no public evidence of active exploitation.
Earlier versions of this analysis (2)
Arbitrary file read in motionEye (pip package 'motioneye', versions before 0.44.0) lets remote attackers retrieve any file readable by the motionEye process by supplying an absolute path to the media playback, movie/picture download, and picture preview handlers. The handlers build paths with os.path.join() - which silently discards the configured media directory when given an absolute path - and the MoviePlaybackHandler further neuters Tornado's StaticFileHandler safety checks by overriding get_absolute_path() and validate_absolute_path() to no-ops. Publicly available exploit code exists (PoC in the GitHub advisory); not listed in CISA KEV.
Absolute path traversal in motionEye (pip package, versions < 0.44.0) allows remote attackers to read arbitrary files from the filesystem via crafted requests to movie playback, movie download, picture download, and picture preview handlers. The handlers pass user-supplied filenames into os.path.join() and explicitly override Tornado's StaticFileHandler validation, so an absolute path such as /etc/motioneye/motion.conf is returned verbatim. Publicly available exploit code exists in the GHSA advisory as a one-line HTTP request, but no public exploit identified at time of analysis beyond the GHSA PoC and no CISA KEV listing.
RemediationAI
Vendor-released patch: upgrade motionEye to 0.44.0 or later (pip install --upgrade motioneye), which is the fixed release per the GHSA advisory at https://github.com/motioneye-project/motioneye/security/advisories/GHSA-rw9q-97r9-8gvh. If you cannot upgrade immediately, place the motionEye web interface (default TCP 8765) behind a reverse proxy or firewall so only trusted, authenticated clients can reach the /movie/ and /picture/ endpoints, and ensure motionEye's admin and normal-user passwords are set so the handlers are not anonymously reachable - note this does not remove the traversal for authenticated users. As stronger containment, run the motionEye process under a dedicated low-privilege account whose filesystem access is confined to its media/target directories so a successful traversal cannot read sensitive files such as /etc/motioneye/motion.conf, accepting that overly tight permissions may break legitimate media playback.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in pypi
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
motionEye is a Python web frontend (built on the Tornado web framework) for the 'motion' surveillance daemon, distributed via PyPI as the 'motioneye' package (pkg:pip/motioneye). The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / path traversal), specifically the absolute-path-traversal variant: mediafiles.get_media_path() builds a path with os.path.join(target_dir, path), and Python's os.path.join() semantics cause an absolute 'path' argument to override and discard 'target_dir' entirely. Tornado's StaticFileHandler normally rejects such paths in validate_absolute_path()/get_absolute_path(), but motionEye's MoviePlaybackHandler overrides both methods to return the user-supplied path unchecked (movie_playback.py lines 111-115), defeating the framework's built-in containment.
Know when Python gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
A single unauthenticated HTTP request reads arbitrary files (AV:N/AC:L/PR:N/UI:N) for high confidentiality loss with no integrity or availability impact; PR:N follows the credential-less PoC though auth-enabled deployments would be PR:L.
Primary rating from Vendor (https://github.com/motioneye-project/motioneye).
CVSS VectorVendor: https://github.com/motioneye-project/motioneye
Lifecycle Timeline
3DescriptionCVE.org
Summary
mEye contains an absolute path traversal vulnerability in multiple media file handlers that allows an attacker to read arbitrary files from the filesystem.
The affected handlers accept a user-controlled filename parameter and construct filesystem paths using os.path.join(). When an absolute path is supplied, Python discards the configured media directory and returns the attacker-supplied path directly. The application then bypasses Tornado's built-in path validation by overriding the relevant safety checks.
As a result, an attacker can access files outside of the configured camera media directory, subject to the permissions of the motionEye process.
Details
The issue exists in the media playback and download functionality.
The filename parameter is passed to mediafiles.get_media_path():
def get_media_path(camera_config, path, media_type):
target_dir = camera_config.get('target_dir')
full_path = os.path.join(target_dir, path)
return full_pathWhen path is an absolute path (e.g. /etc/motioneye/motion.conf), Python's os.path.join() discards target_dir entirely and returns the absolute path as-is. This would normally be caught by Tornado's StaticFileHandler path validation, but MoviePlaybackHandler explicitly overrides both safety checks (movie_playback.py lines 111-115):
def get_absolute_path(self, root, path):
return path
def validate_absolute_path(self, root, absolute_path):
return absolute_pathThis allows reading any file on the filesystem that the motionEye process can access.
The same path traversal exists in the movie download, picture download, and picture preview handlers:
- GET /movie/<camera_id>/download/<filename>
- GET /picture/<camera_id>/download/<filename>
- GET /picture/<camera_id>/preview/<filename>
PoC
GET /movie/1/playback//etc/motioneye/motion.conf HTTP/1.1
Host: target:8765Fix
Do not allow absolute paths supplied by user input.
Validate that the fully resolved canonical path remains within the configured camera media directory before serving a file.
Additionally, Tornado’s built-in path validation should not be bypassed unless equivalent validation is performed by motionEye.
Executive ViewAI
motionEye versions before 0.44.0 contain a remote arbitrary file read vulnerability with publicly available exploit code. The vulnerability allows attackers to retrieve any file accessible by the motionEye process through improper path validation in media playback, download, and preview handlers. Organizations running vulnerable versions must upgrade to version 0.44.0 or later to prevent potential disclosure of configuration files, credentials, and other sensitive data.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution affects Kestra OSS (the open-source event-driven orchestration platform) prior to
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Exploit-DB