Is CVE-2025-60787 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-60787 being exploited in the wild.

How severe is CVE-2025-60787?

High severity, with a CVSS score of 7.2, published 3 October 2025.

Which products and versions are affected?

motioneye (PyPI) ECOSYSTEM:introduced=0,fixed=0.43.1b5.

Is there a fix for CVE-2025-60787?

Yes. motioneye (PyPI): upgrade to 0.43.1b5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-60787 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2025-60787?

Check whether you run motioneye (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-60787: motionEye OS command injection in configuration parameters

CVE-2025-60787 · Severity: high · CVSS 7.2 · Published 2025-10-03

motionEye, a web-based interface for managing video surveillance cameras, is vulnerable to a security flaw that allows administrators to execute unauthorized commands on the underlying server. By providing specially crafted text in configuration settings like file names, an attacker with administrative access can take full control of the system when the service restarts. This could lead to the theft of video footage, surveillance disruption, or the use of the server as a foothold for further attacks on the network.

Technologies: motioneye (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2025-60787 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-60787 being exploited in the wild.
How severe is CVE-2025-60787?: High severity, with a CVSS score of 7.2, published 3 October 2025.
Which products and versions are affected?: motioneye (PyPI) ECOSYSTEM:introduced=0,fixed=0.43.1b5.
Is there a fix for CVE-2025-60787?: Yes. motioneye (PyPI): upgrade to 0.43.1b5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-60787 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2025-60787?: Check whether you run motioneye (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

motioneye (PyPI): upgrade to 0.43.1b5 or later
```
pip install "motioneye>=0.43.1b5"
```

Technical details

An OS command injection vulnerability exists in motionEye versions up to and including 0.43.1b4 due to improper neutralization of special elements in configuration parameters. The application fails to sanitize user-supplied input for fields like 'image_file_name' before writing them to Motion configuration files. An attacker with administrative credentials can bypass client-side validation to inject shell commands. These commands are executed with the privileges of the motionEye process when the Motion service is subsequently restarted. As of the advisory date, no official patch is available, though workarounds involving strict access control for administrative accounts are recommended.

Affected products

motionEye Project motionEye 0.43.1b4 and earlier

Identifiers

CVE-2025-60787
GHSA-j945-qm58-4gjx
PYSEC-2026-1680

Timeline

2025-10-03: advisory: NVD published the CVE record
2025-10-03: disclosed: Public PoC released on GitHub

References

https://github.com/prabhatverma47/motionEye-RCE-through-config-parameter

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.