CVE-2025-47782

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2025-47782
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-47782.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-47782
Aliases
Related
Published
2025-05-14T16:15:29Z
Modified
2025-05-17T14:25:53.988815Z
Summary
[none]
Details

motionEye is an online interface for the software motion, a video surveillance program with motion detection. In versions 0.43.1b1 through 0.43.1b3, using a constructed (camera) device path with the add/add_camera motionEye web API allows an attacker with motionEye admin user credentials to execute any command within a non-interactive shell as motionEye run user, motion by default. The vulnerability has been patched with motionEye v0.43.1b4. As a workaround, apply the patch manually.

References

Affected packages

Git / github.com/motioneye-project/motioneye

Affected ranges

Type
GIT
Repo
https://github.com/motioneye-project/motioneye
Events
Introduced
2862efef79d9c107379459cea9edbb7bbc3d9161
Last affected
e9d629b395879ce75866a76dee2330e04ed864dc

Affected versions

0.*

0.43.1b1
0.43.1b2
0.43.1b3