# motioneye (PyPI) vulnerabilities

9 known vulnerabilities (1 critical, 3 high, 3 medium), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: 0.44.0 (Jun 20, 2026): no advisory affects it
- Newest unaffected release: 0.44.0 (Jun 20, 2026), the latest release
- Weekly downloads: 430
- Dependents: 0
- Releases: 68 since 0.27.0.post1
- Registry: https://pypi.org/project/motioneye/
- Releases read: Nov 8, 2026

## Version timeline

Affected versions per advisory, in version order:

- CVE-2026-55863: 0.27.0.post1 to 0.44.0b3 (0.44.0 is outside it)
- CVE-2026-46488: 0.27.0.post1 to 0.44.0b3 (0.44.0 is outside it)
- CVE-2026-32315: 0.27.0.post1 to 0.44.0b3 (0.44.0 is outside it)
- CVE-2026-31978: 0.27.0.post1 to 0.44.0b3 (0.44.0 is outside it)
- CVE-2026-55488: 0.27.0.post1 to 0.44.0b3 (0.44.0 is outside it)
- CVE-2025-60787: 0.27.0.post1 to 0.43.1b4 (0.43.1b5 is outside it)
- CVE-2025-47782: 0.43.1b1 to 0.43.1b3 (0.43.1b4 is outside it)
- CVE-2022-25568: 0.27.0.post1 to 0.42.1 (0.43.1b1 is outside it)
- CVE-2021-44255: 0.27.0.post1 to 0.42.1 (0.43.1b1 is outside it)

## Advisories (9)

### [CVE-2026-55863](https://cve.now/CVE-2026-55863): motionEye: Missing authentication on ActionHandler allows unauthenticated camera action execution

- Severity: Medium 5.3
- Published: Sep 15, 2026
- Affected: fixed in 0.44.0.
- Fixed in 0.44.0 (released Jun 20, 2026, 87 days before disclosure).
- The latest release, 0.44.0, is not affected.

### [CVE-2026-46488](https://cve.now/CVE-2026-46488): motionEye: Authentication possible via password hash

- Severity: Critical 9.1
- Published: Sep 15, 2026
- Affected: fixed in 0.44.0.
- Fixed in 0.44.0 (released Jun 20, 2026, 87 days before disclosure).
- The latest release, 0.44.0, is not affected.

### [CVE-2026-32315](https://cve.now/CVE-2026-32315): motionEye: World-Readable Configuration File Exposes Admin Password Hash

- Severity: Medium 5.5
- Published: Jun 24, 2026
- Affected: fixed in 0.44.0.
- Fixed in 0.44.0 (released Jun 20, 2026, 4 days before disclosure).
- The latest release, 0.44.0, is not affected.

### [CVE-2026-31978](https://cve.now/CVE-2026-31978): motionEye: Arbitrary File Read via Path Traversal in Picture/Movie Preview Endpoint

- Severity: Medium 6.5
- Published: Jun 24, 2026
- Affected: fixed in 0.44.0.
- Fixed in 0.44.0 (released Jun 20, 2026, 4 days before disclosure).
- The latest release, 0.44.0, is not affected.

### [CVE-2026-55488](https://cve.now/CVE-2026-55488): motionEye's Absolute Path Traversal in Media File Handlers Allows Arbitrary File Read

- Severity: High 7.7
- Published: Jun 24, 2026
- Affected: fixed in 0.44.0.
- Fixed in 0.44.0 (released Jun 20, 2026, 4 days before disclosure).
- The latest release, 0.44.0, is not affected.

### [CVE-2025-60787](https://cve.now/CVE-2025-60787): MotionEye v0.43.1b4 and before is vulnerable to OS Command Injection in configuration parameters such as image\_file\_name.

- Severity: High 7.2
- Published: Oct 3, 2025
- Affected: fixed in 0.43.1b5.
- Fixed in 0.43.1b5 (released Nov 1, 2025, 29 days after disclosure).
- The latest release, 0.44.0, is not affected.

### [CVE-2025-47782](https://cve.now/CVE-2025-47782): motionEye vulnerable to RCE in add\_camera Function Due to unsafe command execution

- Severity: High 8.9
- Published: May 14, 2025
- Affected: from 0.43.1b1, fixed in 0.43.1b4.
- Fixed in 0.43.1b4 (released May 14, 2025, the day of disclosure).
- The latest release, 0.44.0, is not affected.

### [CVE-2022-25568](https://cve.now/CVE-2022-25568): MotionEye v0.42.1 and below allows attackers to access sensitive information via a GET request to /config/list.

- Severity: Unrated
- Published: Mar 24, 2022
- Affected: fixed in 0.43.1b1.
- Fixed in 0.43.1b1 (released Dec 24, 2023, 640 days after disclosure).
- The latest release, 0.44.0, is not affected.

### [CVE-2021-44255](https://cve.now/CVE-2021-44255): Authenticated remote code execution in MotionEye \<= 0.42.1 and MotioneEyeOS \<= 20200606 allows a remote attacker to upload a configuration…

- Severity: Unrated
- Published: Jan 31, 2022
- Affected: through 0.42.1.
- Fixed in 0.43.1 (released Dec 27, 2025, 1426 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).
- The latest release, 0.44.0, is not affected.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/pypi/motioneye
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.