Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability is an absolute path traversal in motionEye, allowing an attacker to read arbitrary files on the filesystem. The root cause lies in the improper handling of user-supplied filenames in various media file handlers. The application uses os.path.join() to construct file paths, and when a user provides an absolute path (e.g., /etc/passwd), os.path.join() discards the intended base directory and returns the absolute path. This issue is particularly exploitable in the MoviePlaybackHandler because it explicitly overrides and disables Tornado's built-in path validation mechanisms (get_absolute_path and validate_absolute_path).
The analysis of the patches between the vulnerable version and the patched version reveals the fix. Initially, in commit bc2afa1818555828e78cb0c7e32830042a57dd1e, a simple check for .. in the path was added to multiple handlers and media file functions. This was later improved in commit dcfee1bd3f15cec3d4414ba790ca2669d2a369c4 by introducing a centralized and more robust validation function, utils.validate_paths, which checks for absolute paths, path traversal sequences, and ensures the final resolved path is within the intended camera media directory.
The identified vulnerable functions are the HTTP handlers that act as entry points for the malicious input (MoviePlaybackHandler.get, MovieHandler.get, PictureHandler.get), the core function mediafiles.get_media_path that constructs the vulnerable path, and the two methods in MoviePlaybackHandler that disable Tornado's security controls.
MoviePlaybackHandler.getmotioneye/handlers/movie_playback.py
MovieHandler.getmotioneye/handlers/movie.py
PictureHandler.getmotioneye/handlers/picture.py
get_media_pathmotioneye/mediafiles.py
MoviePlaybackHandler.get_absolute_pathmotioneye/handlers/movie_playback.py
MoviePlaybackHandler.validate_absolute_pathmotioneye/handlers/movie_playback.py
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| motioneye | pip | < 0.44.0 | 0.44.0 |