Executive brief
motionEye, a web-based interface for video surveillance systems, contains a security flaw that allows unauthorized access to system files. By sending a specially crafted web request, an attacker can bypass security restrictions to read sensitive configuration files or other data stored on the server. This could lead to the exposure of private surveillance data or system credentials, potentially compromising the entire security camera setup.
Technical details
An absolute path traversal vulnerability exists in motionEye's media playback and download handlers (including movie playback, movie download, picture download, and picture preview). The root cause is the insecure use of `os.path.join()` in `mediafiles.get_media_path()`; when a user-supplied `filename` parameter is an absolute path, Python's `os.path.join` discards the intended base directory. Furthermore, the application explicitly overrides Tornado's `StaticFileHandler` safety checks (`get_absolute_path` and `validate_absolute_path`), removing built-in protections against path traversal. An unauthenticated remote attacker can exploit this to read any file on the host filesystem that the motionEye process has permissions to access. The issue is resolved in version 0.44.0.
Affected products
- motioneye-project motionEye < 0.44.0
Timeline
- 2026-06-20: advisory: GitHub Security Advisory published
- 2026-06-24: disclosed: NVD publication date