High severityNVD Advisory· Published Oct 3, 2025· Updated Oct 3, 2025

CVE-2025-60787

Description

MotionEye v0.43.1b4 and before is vulnerable to OS Command Injection in configuration parameters such as image_file_name. Unsanitized user input is written to Motion configuration files, allowing remote authenticated attackers with admin access to achieve code execution when Motion is restarted.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
motioneyePyPI	< 0.43.1b5	0.43.1b5

Affected products

MotionEye/MotionEyedescription
ghsa-coords
pkg:pypi/motioneye
Range: < 0.43.1b5

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-j945-qm58-4gjxghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2025-60787ghsaADVISORY
github.com/motioneye-project/motioneye/security/advisories/GHSA-j945-qm58-4gjxghsaWEB
motioneye-project.commitre

News mentions

No linked articles in our index yet.

cvss	0.455
epss	0.020
exploit	0.030
kev	0.000
patch	0.000
ransomware	0.000