CVE-2025-60787

MotionEye v0.43.1b4 and before is vulnerable to OS Command Injection in configuration parameters such as image_file_name. Unsanitized user input is written to Motion configuration files, allowing remote authenticated attackers with admin access to achieve code execution when Motion is restarted.

Affected products

Motioneye

Motioneye Project Motioneye

= 0.42.1, 0.43.1

CVSS 3.1

7.2 HIGH

EPSS

18.5% (97th percentile)

Weakness

CWE-20, CWE-116, CWE-78

NVD status

Modified

Published

2025-10-03