CVE-2026-31978
Description
motionEye (mEye) is an online interface for motion software, which is a video surveillance program with motion detection. Versions prior to 0.44.0 are vulnerable to path traversal in the picture and movie API endpoints, suhc as /picture/{id}/preview/{filename}. Neither the API handlers, nor the mediafiles.py functions such as get_media_preview() check for .. sequences in the filename parameter, except for get_media_content(). This allows an authenticated user with normal (non-admin) privileges to read arbitrary files from the filesystem as the motionEye process user, such as: /etc/passwd, /etc/shadow, motionEye config files containing password hashes and plaintext passwords, SSH keys, and other cameras' surveillance footage. This issue has been fixed in version 0.44.0.
Summary dbcve.org
motionEye versions before 0.44.0 contain a path traversal vulnerability in picture and movie API endpoints (e.g., /picture/{id}/preview/{filename}). The get_media_preview() and similar functions fail to validate the filename parameter for '..' sequences, allowing authenticated non-admin users to read arbitrary files on the filesystem as the motionEye process user.
Mitigation
Upgrade motionEye to version 0.44.0 or later, which includes proper validation of '..' sequences in filename parameters.