| CVE-2026-55863 | 보통5.3 | motionEye (mEye) is an online interface for a piece of software called "motion," which is a video surveillance program with motion detection. Prior to 0.44.0, the ActionHandler.post() method in motioneye/handlers/action.py lacks the BaseHandler.auth() decorator, allowing an unauthenticated remote attacker to send reque | 15/09/2026 |
| CVE-2026-46488 | 심각9.1 | motionEye (mEye) is an online interface for a piece of software called "motion," which is a video surveillance program with motion detection. Prior to 0.44.0, motionEye accepts the client-controlled meye_username and meye_password_hash cookies as authentication material without server-side session validation. An unauth | 15/09/2026 |
| CVE-2026-32315 | 보통5.5 | motionEye (mEye) is an online interface for motion software, a video surveillance program with motion detection. Versions prior to 0.44.0 create the configuration file /etc/motioneye/motion.conf with 644 permissions (-rw-r--r--), making it readable by any local user on the system. This file contains sensitive data incl | 24/06/2026 |
| CVE-2026-31978 | 보통6.5 | motionEye (mEye) is an online interface for motion software, which is a video surveillance program with motion detection. Versions prior to 0.44.0 are vulnerable to path traversal in the picture and movie API endpoints, suhc as /picture/{id}/preview/{filename}. Neither the API handlers, nor the mediafiles.py functions | 24/06/2026 |
| CVE-2026-55488 | 높음7.7 | motionEye (mEye) is an online interface for a piece of software called "motion," which is a video surveillance program with motion detection. Versions prior to 0.44.0 contain an absolute path traversal vulnerability in multiple media file handlers that allows an attacker to read arbitrary files from the filesystem. The | 24/06/2026 |
| GHSA-phv5-334h-mxcw | 심각 | motionEye Partial Authentication Bypass: Unauthenticated Admin Credential Theft via Path Traversal | 23/06/2026 |
| GHSA-qxvg-h7q2-hcxh | 심각9.8 | motionEye: LFI → pass‑the‑hash admin → unsafe restore → unauth action exec (RCE) | 23/06/2026 |
| CVE-2025-60787 | 높음7.2 | MotionEye v0.43.1b4 and before is vulnerable to OS Command Injection in configuration parameters such as image_file_name. Unsanitized user input is written to Motion configuration files, allowing remote authenticated attackers with admin access to achieve code execution when Motion is restarted. | 03/10/2025 |
| CVE-2025-47782 | 높음8.9 | motionEye is an online interface for the software motion, a video surveillance program with motion detection. In versions 0.43.1b1 through 0.43.1b3, using a constructed (camera) device path with the `add`/`add_camera` motionEye web API allows an attacker with motionEye admin user credentials to execute any command with | 14/05/2025 |
| CVE-2022-25568 | 높음7.5 | MotionEye v0.42.1 and below allows attackers to access sensitive information via a GET request to /config/list. To exploit this vulnerability, a regular user password must be unconfigured. | 24/03/2022 |
| CVE-2021-44255 | 높음7.2 | Authenticated remote code execution in MotionEye <= 0.42.1 and MotioneEyeOS <= 20200606 allows a remote attacker to upload a configuration backup file containing a malicious python pickle file which will execute arbitrary code on the server. | 31/01/2022 |