# CVE-2025-60787: motionEye OS command injection in configuration parameters

Source: https://junglewise.ai/threats/cve-2025-60787-motioneye-os-command-injection-in-configuration-parameters  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-10-03. Updated: 2026-07-05  
License: CC BY 4.0 with a link back

CVE-2025-60787 · Severity: high · CVSS 7.2 · Published 2025-10-03

motionEye, a web-based interface for managing video surveillance cameras, is vulnerable to a security flaw that allows administrators to execute unauthorized commands on the underlying server. By providing specially crafted text in configuration settings like file names, an attacker with administrative access can take full control of the system when the service restarts. This could lead to the theft of video footage, surveillance disruption, or the use of the server as a foothold for further attacks on the network.

Technologies: [motioneye (PyPI)](https://junglewise.ai/threats/technologies/motioneye). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2025-60787 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-60787 being exploited in the wild.

**How severe is CVE-2025-60787?** High severity, with a CVSS score of 7.2, published 3 October 2025.

**Which products and versions are affected?** motioneye (PyPI) ECOSYSTEM:introduced=0,fixed=0.43.1b5.

**Is there a fix for CVE-2025-60787?** Yes. motioneye (PyPI): upgrade to 0.43.1b5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-60787 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2025-60787?** Check whether you run motioneye (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- motioneye (PyPI): upgrade to 0.43.1b5 or later

  ```sh
  pip install "motioneye>=0.43.1b5"
  ```


## Technical details

An OS command injection vulnerability exists in motionEye versions up to and including 0.43.1b4 due to improper neutralization of special elements in configuration parameters. The application fails to sanitize user-supplied input for fields like 'image_file_name' before writing them to Motion configuration files. An attacker with administrative credentials can bypass client-side validation to inject shell commands. These commands are executed with the privileges of the motionEye process when the Motion service is subsequently restarted. As of the advisory date, no official patch is available, though workarounds involving strict access control for administrative accounts are recommended.

## Affected products

- motionEye Project motionEye 0.43.1b4 and earlier

## Identifiers

- CVE-2025-60787
- GHSA-j945-qm58-4gjx
- PYSEC-2026-1680

## Timeline

- 2025-10-03: advisory: NVD published the CVE record
- 2025-10-03: disclosed: Public PoC released on GitHub

## References

- [https://github.com/prabhatverma47/motionEye-RCE-through-config-parameter](https://github.com/prabhatverma47/motionEye-RCE-through-config-parameter)

## Related threats

- [motionEye missing authentication in ActionHandler](https://junglewise.ai/threats/cve-2026-55863-motioneye-missing-authentication-in-actionhandler)
- [motionEye authentication bypass via password hash in cookies](https://junglewise.ai/threats/cve-2026-46488-motioneye-authentication-bypass-via-password-hash-in-cookies)
- [PYSEC-2026-681 - Unrestricted Upload of File with Dangerous Type in motionEye](https://junglewise.ai/threats/cve-2021-44255-unrestricted-upload-of-file-with-dangerous-type-in-motioneye)
- [motionEye insecure file permissions in motion.conf](https://junglewise.ai/threats/cve-2026-32315-motioneye-insecure-file-permissions-in-motion-conf)
- [motionEye path traversal in picture and movie API endpoints](https://junglewise.ai/threats/cve-2026-31978-motioneye-path-traversal-in-picture-and-movie-api-endpoints)