motionEye (mEye) is an online interface for motion software, which is a video surveillance program with motion detection. Versions prior to 0.44.0 are vulnerable to path traversal in the picture and movie API endpoints, suhc as /picture/{id}/preview/{filename}. Neither the API handlers, nor the mediafiles.py functions such as get_media_preview() check for .. sequences in the filename parameter, except for get_media_content(). This allows an authenticated user with normal (non-admin) privileges to read arbitrary files from the filesystem as the motionEye process user, such as: /etc/passwd, /etc/shadow, motionEye config files containing password hashes and plaintext passwords, SSH keys, and other cameras' surveillance footage. This issue has been fixed in version 0.44.0.

Affected: PyPI: motioneye

### Summary

motionEye v0.43.1 (latest stable) is vulnerable to path traversal in the picture and movie API endpoints, like `/picture/{id}/preview/{filename}`. Neither the API handlers, nor the `mediafiles.py` functions like `get_media_preview()` check for `..` sequences in the filename parameter, except `get_media_content()` which does. This allows an authenticated user with normal (non-admin) privileges to read arbitrary files from the filesystem as the motionEye process user.

### Details

The `get_media_content()` function properly validates the path:

```python # mediafiles.py ~line 506 — SAFE def get_media_content(camera_config, path, media_type): target_dir = camera_config['target_dir'] full_path = os.path.join(target_dir, path)

if '..' in path: # <-- PATH TRAVERSAL CHECK PRESENT return None ... ```

But `get_media_preview()` does NOT:

```python # mediafiles.py ~line 910 — VULNERABLE def get_media_preview(camera_config, path, media_type, ...): target_dir = camera_config['target_dir'] full_path = os.path.join(target_dir, path) # <-- NO '..' CHECK ... ```

Similarly, `del_media_content()` at line ~865 is also missing the check. This is a classic inconsistent fix pattern.

The exploit requires `%2F`-encoded slashes (`..%2F..%2F`) which Tornado's URL router does NOT normalize — it passes the raw `../` through to `os.path.join()`.

### PoC

**Step 1:** Authenticate as any user (normal or admin).

**Step 2:** Compute the requ…

Affected: PyPI: motioneye

### Summary

motionEye v0.43.1 (latest stable) is vulnerable to path traversal in the picture and movie API endpoints, like `/picture/{id}/preview/{filename}`. Neither the API handlers, nor the `mediafiles.py` functions like `get_media_preview()` check for `..` sequences in the filename parameter, except `get_media_content()` which does. This allows an authenticated user with normal (non-admin) privileges to read arbitrary files from the filesystem as the motionEye process user.

### Details

The `get_media_content()` function properly validates the path:

```python # mediafiles.py ~line 506 — SAFE def get_media_content(camera_config, path, media_type): target_dir = camera_config['target_dir'] full_path = os.path.join(target_dir, path)

if '..' in path: # <-- PATH TRAVERSAL CHECK PRESENT return None ... ```

But `get_media_preview()` does NOT:

```python # mediafiles.py ~line 910 — VULNERABLE def get_media_preview(camera_config, path, media_type, ...): target_dir = camera_config['target_dir'] full_path = os.path.join(target_dir, path) # <-- NO '..' CHECK ... ```

Similarly, `del_media_content()` at line ~865 is also missing the check. This is a classic inconsistent fix pattern.

The exploit requires `%2F`-encoded slashes (`..%2F..%2F`) which Tornado's URL router does NOT normalize — it passes the raw `../` through to `os.path.join()`.

### PoC

**Step 1:** Authenticate as any user (normal or admin).

**Step 2:** Compute the requ…