Vulnerability Description
motionEye (mEye) is an online interface for motion software, which is a video surveillance program with motion detection. Versions prior to 0.44.0 are vulnerable to path traversal in the picture and movie API endpoints, suhc as /picture/{id}/preview/{filename}. Neither the API handlers, nor the mediafiles.py functions such as get_media_preview() check for .. sequences in the filename parameter, except for get_media_content(). This allows an authenticated user with normal (non-admin) privileges to read arbitrary files from the filesystem as the motionEye process user, such as: /etc/passwd, /etc/shadow, motionEye config files containing password hashes and plaintext passwords, SSH keys, and other cameras' surveillance footage. This issue has been fixed in version 0.44.0.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/motioneye-project/motioneye/releases/tag/0.44.0
- https://github.com/motioneye-project/motioneye/security/advisories/GHSA-g9fx-5r4
- https://github.com/motioneye-project/motioneye/security/advisories/GHSA-g9fx-5r4
FAQ
What is CVE-2026-31978?
CVE-2026-31978 is a vulnerability with a CVSS score of 6.5 (MEDIUM). motionEye (mEye) is an online interface for motion software, which is a video surveillance program with motion detection. Versions prior to 0.44.0 are vulnerable to path traversal in the picture and m...
How severe is CVE-2026-31978?
CVE-2026-31978 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-31978?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.