p PatchFirst

CVE-2025-60787

CVE-2025-60787

This page contains facts from public vulnerability sources. Check the original advisory before updating.

MotionEye v0.43.1b4 and before is vulnerable to OS Command Injection in configuration parameters such as image_file_name. Unsanitized user input is written to Motion configuration files, allowing remote authenticated attackers with admin access to achieve code execution when Motion is restarted.

CVSS 7.2 · High · EPSS 18.5% · Public exploit · Fix available

Published
Updated

Stack: python

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • motioneye PyPI

    Versions
    • 0.27
    • 0.27.1
    • 0.27.2
    • 0.28
    • 0.28.1
    • 0.28.2
    • 0.28.3
    • 0.29
    • 0.29.1
    • 0.29rc1
    • 0.29rc2
    • 0.30
    • 0.30rc1
    • 0.30rc2
    • 0.31
    • 0.31.1
    • 0.31.2
    • 0.31.3
    • 0.31.4
    • 0.31.5
    • 0.32
    • 0.32.1
    • 0.32.2
    • 0.33
    • 0.33.1
    • 0.33.2
    • 0.33.3
    • 0.33.4
    • 0.34
    • 0.34.1
    • 0.34rc1
    • 0.35
    • 0.35.1
    • 0.35.2
    • 0.35rc1
    • 0.36
    • 0.36.1
    • 0.37
    • 0.37.1
    • 0.37rc1
    • 0.38
    • 0.38.1
    • 0.39
    • 0.39.1
    • 0.39.2
    • 0.39.3
    • 0.40
    • 0.40rc1
    • 0.40rc2
    • 0.40rc3
    • 0.40rc4
    • 0.40rc5
    • 0.41
    • 0.41rc1
    • 0.42
    • 0.42.1
    • 0.43.1b1
    • 0.43.1b2
    • 0.43.1b3
    • 0.43.1b4
    Affected ranges
    • ECOSYSTEM: < 0.43.1b5

    Update to 0.43.1b5

Original sources

Check your server →