VYPR
← All advisories
High severity7.2NVD Advisory· Published Oct 3, 2025· Updated Jul 5, 2026

CVE-2025-60787

CVE-2025-60787

Description

MotionEye v0.43.1b4 and before is vulnerable to OS Command Injection in configuration parameters such as image_file_name. Unsanitized user input is written to Motion configuration files, allowing remote authenticated attackers with admin access to achieve code execution when Motion is restarted.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
motioneyePyPI
< 0.43.1b50.43.1b5

Affected products

7
  • Motioneye Project/Motioneye5 versions
    cpe:2.3:a:motioneye_project:motioneye:0.42.1:*:*:*:*:*:*:*+ 4 more
    • cpe:2.3:a:motioneye_project:motioneye:0.42.1:*:*:*:*:*:*:*
    • cpe:2.3:a:motioneye_project:motioneye:0.43.1:beta1:*:*:*:*:*:*
    • cpe:2.3:a:motioneye_project:motioneye:0.43.1:beta2:*:*:*:*:*:*
    • cpe:2.3:a:motioneye_project:motioneye:0.43.1:beta3:*:*:*:*:*:*
    • cpe:2.3:a:motioneye_project:motioneye:0.43.1:beta4:*:*:*:*:*:*
  • MotionEye/MotionEyedescription
  • ghsa-coords
    pkg:pypi/motioneye
    Range: < 0.43.1b5

Patches

Vulnerability mechanics

References

3

News mentions

0

No linked articles in our index yet.