CVE-2025-47782highCWE-78

CVE-2025-47782: high-severity vulnerability in motioneye-project motioneye

motionEye vulnerable to RCE in add_camera Function Due to unsafe command execution

Published

Follow this CVE+ Monitor motioneye+ Monitor motioneye

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.9epss 0.5%
motionEye is an online interface for the software motion, a video surveillance program with motion detection. In versions 0.43.1b1 through 0.43.1b3, using a constructed (camera) device path with the `add`/`add_camera` motionEye web API allows an attacker with motionEye admin user credentials to execute any command within a non-interactive shell as motionEye run user, `motion` by default. The vulnerability has been patched with motionEye v0.43.1b4. As a workaround, apply the patch manually.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Affected products
motioneye-project · motioneye
Related CVEs — motioneye-project motioneye

In the same product, most dangerous first.

CVE-2026-32315MEDIUMmotionEye: World-Readable Configuration File Exposes Admin Password HashEPSS 1.7%CVE-2026-55488HIGHmotionEye's Absolute Path Traversal in Media File Handlers Allows Arbitrary File ReadEPSS 0.6%CVE-2026-55863MEDIUMmotionEye: Missing authentication on ActionHandler allows unauthenticated camera action executionEPSS 0.5%CVE-2026-46488CRITICALmotionEye: Authentication possible via password hashEPSS 0.5%CVE-2026-31978MEDIUMmotionEye: Arbitrary File Read via Path Traversal in Picture/Movie Preview EndpointEPSS 0.3%