CVE-2025-60787

high · 7.2

MotionEye v0.43.1b4 and before is vulnerable to OS Command Injection in configuration parameters such as image_file_name. Unsanitized user input is written to Motion configuration files, allowing remote authenticated attackers with admin access to achieve code execution when Motion is restarted.

7.2

CVSS

18.5%

EPSS (exploit prob.)

97th

EPSS percentile

2025-10-03

Published

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-20CWE-78CWE-116

Affected products

Vendor	Product	Affected versions
motioneye_project	motioneye	0.42.1
motioneye_project	motioneye	0.43.1
motioneye_project	motioneye	0.43.1
motioneye_project	motioneye	0.43.1
motioneye_project	motioneye	0.43.1

Check a specific version with /api/v1/cve/match.

References

https://github.com/prabhatverma47/motionEye-RCE-through-config-parameter

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-60787