CVE-2026-31978: motionEye Path Traversal Allows Authenticated File Read (v0.44.0)

Technical summary

The vulnerability exists in motionEye's picture and movie API endpoints (e.g., /picture/{id}/preview/{filename}) which fail to sanitize the filename parameter for directory traversal sequences. While the get_media_content() function implements checks to prevent .. traversal, the API handlers and related functions in mediafiles.py (such as get_media_preview()) do not enforce equivalent validation. This inconsistency allows an authenticated, non-privileged user to construct requests with path sequences (e.g., ../../etc/passwd) that bypass validation and are processed by the underlying file retrieval logic running under the motionEye process user's privileges. The issue is classified under CWE-22 (Path Traversal) and CWE-284 (Improper Access Control).

Business impact

Compromise of sensitive data accessible to the motionEye process user, including system-level credentials and SSH keys, could facilitate lateral movement or privilege escalation within the hosting environment. Exposure of camera configurations and other users' surveillance footage creates privacy violations and potential compliance violations (GDPR, HIPAA, etc.). The fact that only user-level authentication is required—not admin access—significantly broadens the attack surface; any person with a motionEye account (including guest or contractor accounts) could extract this data. Organizations relying on motionEye for surveillance must assume that file contents accessible to the motionEye service are now at risk.

Affected systems

All installations of motionEye versions prior to 0.44.0 are affected. The vulnerability is reachable by any user with valid credentials to the motionEye web interface, regardless of their privilege level. motionEye deployments in containerized, VM, or bare-metal environments are equally vulnerable; the actual exposure depends on what files and filesystem paths are readable by the motionEye process user (which varies by OS and deployment).

Exploitability

Exploitability is straightforward. The attack requires only network access to the motionEye web interface and a valid user account (even a low-privilege one). No special tools or advanced techniques are necessary—standard HTTP requests with manipulated filename parameters are sufficient. The CVSS score of 6.5 reflects the moderate risk: high confidentiality impact, but limited to already-authenticated users and no impact on system integrity or availability. However, the ease of exploitation and the sensitivity of files typically exposed make this a practical threat in production environments.

Remediation

Upgrade motionEye to version 0.44.0 or later, which implements proper path traversal validation across all affected endpoints. Organizations unable to upgrade immediately should restrict network access to the motionEye web interface to trusted users only, implement strong authentication (multi-factor if possible), and monitor API access logs for suspicious filename patterns (e.g., requests containing .., /, or absolute paths).

Patch guidance

Apply the upgrade to motionEye 0.44.0 as soon as feasible. Verify the upgrade in a non-production environment first to confirm compatibility with your surveillance workflow and any custom configurations. The patch should be applied to all motionEye instances, including those in production. If you are running motionEye in a container, rebuild and redeploy the image with the patched version. Review and update any automation or scripts that interact with the motionEye API to ensure they do not inadvertently rely on path traversal behavior.

Detection guidance

Monitor HTTP access logs for requests to picture and movie API endpoints (/picture/*/preview/*, /movie/*/preview/*) that contain path traversal sequences such as .., encoded variants (%2e%2e), or unusual file paths (e.g., /etc/passwd, /root/.ssh). Log and alert on authentication attempts from unusual IP addresses. If you have HTTP request logging enabled on the motionEye application, examine logs for attempts to access files outside the expected media directories. Consider implementing a Web Application Firewall (WAF) rule to block requests with suspicious filename patterns to the affected endpoints.

Why prioritize this

This vulnerability warrants prompt patching because it provides a low-friction path to sensitive file disclosure for any motionEye user. Exposed files typically include plaintext or hashed passwords, SSH keys, and other system configuration data that can be leveraged for further attacks. The requirement for only user-level authentication—not admin—means the threat actor pool is large. While the CVSS score is moderate (6.5), the practical business impact in a surveillance environment is higher due to privacy and compliance implications.

Risk score, explained

The CVSS 3.1 score of 6.5 (MEDIUM) reflects: high confidentiality impact (C:H) from arbitrary file read, no integrity or availability impact, low attack complexity (AC:L), network accessibility (AV:N), and the need for user-level privileges (PR:L). The score appropriately captures the severity of data disclosure but does not fully account for the downstream risk if exposed credentials or keys are used for lateral movement. Organizations should treat this as a higher practical priority than the base CVSS might suggest, especially if motionEye has access to sensitive areas of the filesystem.

Frequently asked questions