# CVE-2025-47782: motionEye vulnerable to RCE in add_camera Function Due to unsafe command execution

Source: https://junglewise.ai/threats/cve-2025-47782-motioneye-vulnerable-to-rce-in-add-camera-function-due-to-unsafe  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-05-14  
License: CC BY 4.0 with a link back

CVE-2025-47782 · Severity: medium · CVSS 4 · Published 2025-05-14

motionEye is an online interface for the software motion, a video surveillance program with motion detection. In versions 0.43.1b1 through 0.43.1b3, using a constructed (camera) device path with the `add`/`add_camera` motionEye web API allows an attacker with motionEye admin user credentials to execute any command within a non-interactive shell as motionEye run user, `motion` by default. The vulnerability has been patched with motionEye v0.43.1b4. As a workaround, apply the patch manually.

Technologies: [motioneye (PyPI)](https://junglewise.ai/threats/technologies/motioneye). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2025-47782 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-47782 being exploited in the wild.

**How severe is CVE-2025-47782?** Medium severity, with a CVSS score of 4, published 14 May 2025.

**Which products and versions are affected?** motioneye (PyPI) ECOSYSTEM:introduced=0.43.1b1,fixed=0.43.1b4.

**Is there a fix for CVE-2025-47782?** Yes. motioneye (PyPI): upgrade to 0.43.1b4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2025-47782?** Check whether you run motioneye (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- motioneye (PyPI): upgrade to 0.43.1b4 or later

  ```sh
  pip install "motioneye>=0.43.1b4"
  ```


## Affected products

- motioneye (PyPI) ECOSYSTEM:introduced=0.43.1b1,fixed=0.43.1b4

## Identifiers

- CVE-2025-47782
- GHSA-g5mq-prx7-c588
- PYSEC-2025-39

## Related threats

- [motionEye missing authentication in ActionHandler](https://junglewise.ai/threats/cve-2026-55863-motioneye-missing-authentication-in-actionhandler)
- [motionEye authentication bypass via password hash in cookies](https://junglewise.ai/threats/cve-2026-46488-motioneye-authentication-bypass-via-password-hash-in-cookies)
- [PYSEC-2026-681 - Unrestricted Upload of File with Dangerous Type in motionEye](https://junglewise.ai/threats/cve-2021-44255-unrestricted-upload-of-file-with-dangerous-type-in-motioneye)
- [motionEye insecure file permissions in motion.conf](https://junglewise.ai/threats/cve-2026-32315-motioneye-insecure-file-permissions-in-motion-conf)
- [motionEye path traversal in picture and movie API endpoints](https://junglewise.ai/threats/cve-2026-31978-motioneye-path-traversal-in-picture-and-movie-api-endpoints)