What’s Vulnerable › Vulnerabilities

CVE-2025-60787

• Severity: high (CVSS 7.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 18.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-10-03 · updated 2026-07-05
• Weakness: CWE-20

Description

MotionEye v0.43.1b4 and before is vulnerable to OS Command Injection in configuration parameters such as image_file_name. Unsanitized user input is written to Motion configuration files, allowing remote authenticated attackers with admin access to achieve code execution when Motion is restarted.

Affected products

• Motioneye Project Motioneye: 0.42.1, 0.43.1-beta1, 0.43.1-beta2, 0.43.1-beta3, 0.43.1-beta4

References

• https://github.com/prabhatverma47/motionEye-RCE-through-config-parameter

Get alerted when CVE-2025-60787 or the next vulnerability affects your stack