https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 17:07:39 +0000 https://cve.radiocsirt.org/vuln/cve-2025-47782 <p><strong>Affected:</strong> motioneye-project motioneye</p> <p>motionEye is an online interface for the software motion, a video surveillance program with motion detection. In versions 0.43.1b1 through 0.43.1b3, using a constructed (camera) device path with the `add`/`add_camera` motionEye web API allows an attacker with motionEye admin user credentials to execute any command within a non-interactive shell as motionEye run user, `motion` by default. The vulnerability has been patched with motionEye v0.43.1b4. As a workaround, apply the patch manually.</p> <p><strong>Affected:</strong> motioneye-project motioneye</p> <p>motionEye is an online interface for the software motion, a video surveillance program with motion detection. In versions 0.43.1b1 through 0.43.1b3, using a constructed (camera) device path with the `add`/`add_camera` motionEye web API allows an attacker with motionEye admin user credentials to execute any command within a non-interactive shell as motionEye run user, `motion` by default. The vulnerability has been patched with motionEye v0.43.1b4. As a workaround, apply the patch manually.</p> https://cve.radiocsirt.org/vuln/cve-2025-47782 https://cve.radiocsirt.org/vuln/ghsa-g5mq-prx7-c588 <p><strong>Affected:</strong> PyPI: motioneye</p> <p>### Summary Using a constructed (camera) device path with the `config/add`/`add_camera` motionEye web API allows an attacker with motionEye admin user credentials to execute any UNIX shell code within a non-interactive shell as executing user of the motionEye instance, `motion` by default.</p> <p>#### function call stack 1. `post` 2. `add_camera` 3. `config.add_camera` 4. `v4l2ctl.list_resolutions` 5. `utils.call_subprocess` 6. `subprocess.run`</p> <p>### PoC #### build ```sh RUN_USER=&#34;user&#34; RUN_UID=$(id -u ${RUN_USER}) RUN_GID=$(id -g ${RUN_USER}) TIMESTAMP=&#34;$(date &#39;+%Y%m%d-%H%M&#39;)&#34;</p> <p>docker build \ --network host \ --build-arg=&#34;RUN_UID=${RUN_UID?}&#34; \ --build-arg=&#34;RUN_GID=${RUN_GID?}&#34; \ -t &#34;${USER?}/motioneye:${TIMESTAMP}&#34; \ --no-cache \ -f docker/Dockerfile . ```</p> <p>#### reproduce Run: ```sh docker run --rm -d -p 8765:8765 --hostname=&#34;motioneye&#34; -v /etc/localtime:/etc/localtime:ro -v /tmp/motioneyeconfig:/etc/motioneye -v /tmp/motioneyeconfig:/var/lib/motioneye ``` ```console bash-4.2$ docker logs ceb435eacf55 -f configure_logging cmd motioneye: False configure logging to file: None INFO: hello! this is motionEye server 0.43.1b3 DEBUG: found motion executable &#34;/usr/bin/motion&#34; version &#34;4.7.0&#34; DEBUG: found ffmpeg executable &#34;/usr/bin/ffmpeg&#34; version &#34;7.1.1-1+b1&#34; DEBUG: listing config dir /etc/motioneye... DEBUG: found camera with id 1 DEBUG: reading camera config from /etc/motioneye/camera-1.conf... DEBUG: loading additional config structure for…</p> <p><strong>Affected:</strong> PyPI: motioneye</p> <p>### Summary Using a constructed (camera) device path with the `config/add`/`add_camera` motionEye web API allows an attacker with motionEye admin user credentials to execute any UNIX shell code within a non-interactive shell as executing user of the motionEye instance, `motion` by default.</p> <p>#### function call stack 1. `post` 2. `add_camera` 3. `config.add_camera` 4. `v4l2ctl.list_resolutions` 5. `utils.call_subprocess` 6. `subprocess.run`</p> <p>### PoC #### build ```sh RUN_USER=&#34;user&#34; RUN_UID=$(id -u ${RUN_USER}) RUN_GID=$(id -g ${RUN_USER}) TIMESTAMP=&#34;$(date &#39;+%Y%m%d-%H%M&#39;)&#34;</p> <p>docker build \ --network host \ --build-arg=&#34;RUN_UID=${RUN_UID?}&#34; \ --build-arg=&#34;RUN_GID=${RUN_GID?}&#34; \ -t &#34;${USER?}/motioneye:${TIMESTAMP}&#34; \ --no-cache \ -f docker/Dockerfile . ```</p> <p>#### reproduce Run: ```sh docker run --rm -d -p 8765:8765 --hostname=&#34;motioneye&#34; -v /etc/localtime:/etc/localtime:ro -v /tmp/motioneyeconfig:/etc/motioneye -v /tmp/motioneyeconfig:/var/lib/motioneye ``` ```console bash-4.2$ docker logs ceb435eacf55 -f configure_logging cmd motioneye: False configure logging to file: None INFO: hello! this is motionEye server 0.43.1b3 DEBUG: found motion executable &#34;/usr/bin/motion&#34; version &#34;4.7.0&#34; DEBUG: found ffmpeg executable &#34;/usr/bin/ffmpeg&#34; version &#34;7.1.1-1+b1&#34; DEBUG: listing config dir /etc/motioneye... DEBUG: found camera with id 1 DEBUG: reading camera config from /etc/motioneye/camera-1.conf... DEBUG: loading additional config structure for…</p> https://cve.radiocsirt.org/vuln/ghsa-g5mq-prx7-c588