CVE-2026-31978: motionEye Path Traversal Vulnerability

CVE-2026-31978 Overview

CVE-2026-31978 is a path traversal vulnerability [CWE-22] in motionEye (mEye), an online interface for the motion video surveillance software. Versions prior to 0.44.0 fail to sanitize the filename parameter in the picture and movie API endpoints, such as /picture/{id}/preview/{filename}. An authenticated non-admin user can supply .. sequences to read arbitrary files from the host filesystem as the motionEye process user. Exposed data includes /etc/passwd, /etc/shadow, motionEye configuration files containing password hashes and plaintext credentials, SSH keys, and surveillance footage from other cameras.

Critical Impact
Authenticated low-privilege users can read arbitrary files, including credential stores and SSH keys, from systems running motionEye versions before 0.44.0.

Affected Products

motionEye (mEye) versions prior to 0.44.0
Deployments exposing the picture API endpoint /picture/{id}/preview/{filename}
Deployments exposing movie API endpoints handled through mediafiles.py

Discovery Timeline

2026-06-24 - CVE-2026-31978 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-31978

Vulnerability Analysis

The vulnerability resides in motionEye's media handling logic. API handlers for the picture and movie endpoints accept a filename parameter that is forwarded to helper functions in mediafiles.py, including get_media_preview(). These functions do not validate or normalize the filename argument before resolving it against the on-disk media directory.

Only get_media_content() performs checks for .. sequences. The other handlers inherit no such validation. Authenticated requests can therefore reference paths outside the intended media root by injecting parent directory traversal segments.

Because motionEye routinely runs with broad filesystem access to read configuration and camera footage, the process user can typically reach sensitive files. These include /etc/passwd, /etc/shadow on systems where the process runs as root, motionEye configuration files with credentials, and SSH private keys.

Root Cause

The root cause is missing input validation on the filename parameter in the picture and movie API handlers and in helper functions in mediafiles.py. The application trusts the caller-supplied path component and concatenates it with the media directory without canonicalization or boundary enforcement.

Attack Vector

Exploitation requires network access to the motionEye web interface and valid credentials for any account, including non-administrator users. The attacker issues an HTTP request to a vulnerable endpoint such as /picture/{id}/preview/{filename}, substituting traversal sequences for {filename} to escape the media directory. The server returns the contents of the targeted file in the response body. No user interaction is required beyond the attacker's own request.

No verified public exploit code is referenced in the advisory. See the GitHub Security Advisory GHSA-g9fx-5r4h-pcw3 for additional technical context.

Detection Methods for CVE-2026-31978

Indicators of Compromise

HTTP requests to /picture/ or movie API routes containing .., %2e%2e, or URL-encoded path separators in the filename segment.
Web server access logs showing authenticated sessions retrieving unusual file paths or non-media file extensions.
Unexpected reads of /etc/passwd, /etc/shadow, SSH key files, or motionEye configuration files by the motionEye process user.
Spikes in response sizes from media endpoints inconsistent with the configured camera media.

Detection Strategies

Inspect reverse proxy and application logs for path traversal patterns in motionEye URL paths.
Audit filesystem access by the motionEye process user using auditd rules on sensitive paths such as /etc/shadow and ~/.ssh/.
Compare authenticated user activity against expected camera access scopes to identify lateral footage retrieval.

Monitoring Recommendations

Enable verbose access logging on the motionEye HTTP listener and forward logs to a centralized analytics platform.
Alert on any 200-status response to a motionEye media endpoint whose URL contains traversal tokens after normalization.
Track non-admin user activity for access patterns crossing camera ownership boundaries.

How to Mitigate CVE-2026-31978

Immediate Actions Required

Upgrade motionEye to version 0.44.0 or later, where the input validation fix is applied.
Rotate any credentials, password hashes, and SSH keys reachable by the motionEye process user, since prior exposure cannot be ruled out.
Restrict network access to the motionEye web interface to trusted management networks until patching is complete.
Review motionEye user accounts and remove unused or shared low-privilege accounts that could be abused for authenticated exploitation.

Patch Information

The maintainers fixed the issue in motionEye 0.44.0. Release notes and source artifacts are available at the motionEye 0.44.0 GitHub Release. Advisory details are documented in GHSA-g9fx-5r4h-pcw3.

Workarounds

Run the motionEye process as a dedicated unprivileged user with filesystem access limited to required media directories.
Place motionEye behind a reverse proxy that rejects requests containing .., %2e%2e, or other normalized traversal sequences in the URL path.
Enforce strong authentication and disable non-essential accounts on motionEye until the upgrade is deployed.

bash

# Example NGINX rule to block path traversal attempts to motionEye media endpoints
location ~ ^/(picture|movie)/ {
    if ($request_uri ~* "(\.\./|%2e%2e/|%2e%2e%2f)") {
        return 403;
    }
    proxy_pass http://motioneye_backend;
}