CVE-2025-60787 motionEye vulnerable to RCE via unsanitized motion config parameter
Authenticated administrators can execute arbitrary OS commands via unsanitized configuration parameters in MotionEye.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-60787?
CVE-2025-60787 is a high-severity command injection vulnerability in n/a, published on 3 Oct 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
MotionEye v0.43.1b4 and before is vulnerable to OS Command Injection in configuration parameters such as image_file_name. Unsanitized user input is written to Motion configuration files, allowing remote authenticated attackers with admin access to achieve code execution when Motion is restarted.
Which versions are affected by CVE-2025-60787?
3 open source packages ship an affected version, including motioneye. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
motioneye PyPI | All versions | 0.43.1b5 |
motioneye PyPI | All versions | 0.43.1b5 |
motioneye PyPI | All versions | 0.43.1b5 |
Products include Motioneye Project Motioneye.
How do I fix CVE-2025-60787?
Upgrade motioneye to 0.43.1b5 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2025-60787 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-60787 exists.
Public exploit code: 1 Metasploit module, 1 Exploit-DB entry and 9 proofs of concept on GitHub.
Other vulnerabilities in n/a
Sources
Also known as GHSA-j945-qm58-4gjx, PYSEC-2026-1680.