What’s Vulnerable › Vulnerabilities

CVE-2025-47782: motionEye vulnerable to RCE in add_camera Function Due to unsafe command execution

• Severity: high (CVSS 8.9 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-05-14 · updated 2026-06-17
• Weakness: CWE-78

Description

motionEye is an online interface for the software motion, a video surveillance program with motion detection. In versions 0.43.1b1 through 0.43.1b3, using a constructed (camera) device path with the `add`/`add_camera` motionEye web API allows an attacker with motionEye admin user credentials to execute any command within a non-interactive shell as motionEye run user, `motion` by default. The vulnerability has been patched with motionEye v0.43.1b4. As a workaround, apply the patch manually.

Affected products

• motioneye-project motioneye: from 0.43.1b1, < 0.43.1b4

References

• https://github.com/motioneye-project/motioneye/issues/3142
• https://github.com/motioneye-project/motioneye/pull/3143
• https://github.com/motioneye-project/motioneye/security/advisories/GHSA-g5mq-prx7-c588
• https://github.com/motioneye-project/motioneye/security/advisories/GHSA-g5mq-prx7-c588

Get alerted when CVE-2025-47782 or the next vulnerability affects your stack