PyPIPackage

motioneye

9 known vulnerabilities (1 critical, 3 high, 3 medium), with the versions each affects and the releases that fix them.

Latest release: 0.44.0 (Jun 20, 2026): no advisory affects it
Newest unaffected release: 0.44.0 (Jun 20, 2026), the latest release
Advisories: 9 · 1 critical, 3 high, 3 medium

Weekly downloads: 430
Dependents: 0
Releases: 68 since 0.27.0.post1
Registry: PyPI
Releases read: Nov 8, 2026

Version timeline

CVE-2026-55863
Affects 0.27.0.post1 to 0.44.0b3 (0.44.0 is outside it)
CVE-2026-46488
Affects 0.27.0.post1 to 0.44.0b3 (0.44.0 is outside it)
CVE-2026-32315
Affects 0.27.0.post1 to 0.44.0b3 (0.44.0 is outside it)
CVE-2026-31978
Affects 0.27.0.post1 to 0.44.0b3 (0.44.0 is outside it)
CVE-2026-55488
Affects 0.27.0.post1 to 0.44.0b3 (0.44.0 is outside it)
CVE-2025-60787
Affects 0.27.0.post1 to 0.43.1b4 (0.43.1b5 is outside it)
CVE-2025-47782
Affects 0.43.1b1 to 0.43.1b3 (0.43.1b4 is outside it)
CVE-2022-25568
Affects 0.27.0.post1 to 0.42.1 (0.43.1b1 is outside it)
CVE-2021-44255
Affects 0.27.0.post1 to 0.42.1 (0.43.1b1 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 9

CVE-2026-55863Medium 5.3
motionEye: Missing authentication on ActionHandler allows unauthenticated camera action execution
Affected: fixed in 0.44.0.
Fixed in 0.44.0 (released Jun 20, 2026, 87 days before disclosure).
The latest release, 0.44.0, is not affected.
CVE-2026-46488Critical 9.1
motionEye: Authentication possible via password hash
Affected: fixed in 0.44.0.
Fixed in 0.44.0 (released Jun 20, 2026, 87 days before disclosure).
The latest release, 0.44.0, is not affected.
CVE-2026-32315Medium 5.5
motionEye: World-Readable Configuration File Exposes Admin Password Hash
Affected: fixed in 0.44.0.
Fixed in 0.44.0 (released Jun 20, 2026, 4 days before disclosure).
The latest release, 0.44.0, is not affected.
CVE-2026-31978Medium 6.5
motionEye: Arbitrary File Read via Path Traversal in Picture/Movie Preview Endpoint
Affected: fixed in 0.44.0.
Fixed in 0.44.0 (released Jun 20, 2026, 4 days before disclosure).
The latest release, 0.44.0, is not affected.
CVE-2026-55488High 7.7
motionEye's Absolute Path Traversal in Media File Handlers Allows Arbitrary File Read
Affected: fixed in 0.44.0.
Fixed in 0.44.0 (released Jun 20, 2026, 4 days before disclosure).
The latest release, 0.44.0, is not affected.
CVE-2025-60787High 7.2
MotionEye v0.43.1b4 and before is vulnerable to OS Command Injection in configuration parameters such as image_file_name.
Affected: fixed in 0.43.1b5.
Fixed in 0.43.1b5 (released Nov 1, 2025, 29 days after disclosure).
The latest release, 0.44.0, is not affected.
CVE-2025-47782High 8.9
motionEye vulnerable to RCE in add_camera Function Due to unsafe command execution
Affected: from 0.43.1b1, fixed in 0.43.1b4.
Fixed in 0.43.1b4 (released May 14, 2025, the day of disclosure).
The latest release, 0.44.0, is not affected.
CVE-2022-25568Unrated
MotionEye v0.42.1 and below allows attackers to access sensitive information via a GET request to /config/list.
Affected: fixed in 0.43.1b1.
Fixed in 0.43.1b1 (released Dec 24, 2023, 640 days after disclosure).
The latest release, 0.44.0, is not affected.
CVE-2021-44255Unrated
Authenticated remote code execution in MotionEye <= 0.42.1 and MotioneEyeOS <= 20200606 allows a remote attacker to upload a configuration…
Affected: through 0.42.1.
Fixed in 0.43.1 (released Dec 27, 2025, 1426 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).
The latest release, 0.44.0, is not affected.