CVE-2026-55488: motionEye Path Traversal Vulnerability

CVE-2026-55488 Overview

CVE-2026-55488 is an absolute path traversal vulnerability [CWE-22] in motionEye (mEye), a web-based interface for the motion video surveillance program. Versions prior to 0.44.0 accept a user-controlled filename parameter across multiple media file handlers. The handlers construct filesystem paths using Python's os.path.join(), which discards the configured media directory when an absolute path is supplied. The application further overrides Tornado's built-in path validation, defeating its safety checks. An unauthenticated remote attacker can read arbitrary files from the host filesystem, limited only by the permissions of the motionEye process. Version 0.44.0 resolves the issue.

Critical Impact
Unauthenticated network-based attackers can read arbitrary files from systems running motionEye, exposing configuration files, credentials, and other sensitive data accessible to the motionEye process.

Affected Products

motionEye versions prior to 0.44.0
All deployments exposing the motionEye web interface to untrusted networks
Camera surveillance systems built on the motionEye-project stack

Discovery Timeline

2026-06-24 - CVE-2026-55488 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-55488

Vulnerability Analysis

The vulnerability resides in motionEye's media file handler endpoints, which expose recorded video and image files to authorized clients. Each handler accepts a filename parameter supplied by the caller and concatenates it with the configured media directory using os.path.join(). Python's path joining semantics treat any component beginning with / as an absolute path, silently discarding all prior path segments. As a result, a request containing an absolute path overrides the intended media root entirely.

The Tornado web framework provides a validate_absolute_path() hook that normally rejects requests that escape the configured static root. motionEye overrides this validation in the affected handlers, removing the last layer of defense. With both controls bypassed, the file delivery logic returns whatever file the attacker references, provided the motionEye process has read access. On many home and small-business deployments motionEye runs with elevated privileges, expanding the disclosure scope to system files such as /etc/passwd, /etc/shadow, configuration secrets, and stored credentials.

Root Cause

The root cause is unsafe use of os.path.join() against attacker-controlled input combined with the deliberate disabling of Tornado's absolute path validation. The handlers trust the filename parameter and perform no canonicalization, prefix checking, or boundary enforcement before opening the resulting path.

Attack Vector

An attacker reaches the vulnerability over the network by issuing an HTTP request to a vulnerable media handler endpoint. By supplying an absolute filesystem path in the filename parameter, the attacker causes the server to read and return the contents of the targeted file. No authentication, user interaction, or local access is required, and exploitation complexity is low.

Detailed proof-of-concept request structures are documented in the GitHub Security Advisory GHSA-rw9q-97r9-8gvh.

Detection Methods for CVE-2026-55488

Indicators of Compromise

HTTP requests to motionEye media handler endpoints containing absolute path values in the filename parameter, such as values beginning with /etc/, /root/, or /home/.
Web server access logs showing successful 200 responses for requests referencing files outside the configured camera media directory.
Unexpected reads of system files (/etc/passwd, /etc/shadow, SSH keys) by the motionEye process user.

Detection Strategies

Inspect motionEye and reverse-proxy access logs for filename query parameters containing leading slashes or encoded variants such as %2F.
Apply web application firewall rules that block path traversal patterns and absolute paths in query string parameters targeting motionEye routes.
Correlate process-level file access telemetry with the motionEye service account to flag reads outside the media directory.

Monitoring Recommendations

Enable verbose HTTP request logging on motionEye and any fronting reverse proxy and forward logs to a central analytics platform.
Monitor outbound responses from motionEye for content types and sizes inconsistent with expected media files.
Alert on first-seen file paths accessed by the motionEye process, particularly outside its configured working directory.

How to Mitigate CVE-2026-55488

Immediate Actions Required

Upgrade motionEye to version 0.44.0 or later, which removes the absolute path handling flaw.
Restrict network exposure of the motionEye interface to trusted management networks or place it behind an authenticated reverse proxy or VPN.
Run the motionEye service under a dedicated low-privilege user account with read access limited to the media directory.
Rotate any secrets, SSH keys, or credentials that may have been readable by the motionEye process during the exposure window.

Patch Information

The motionEye maintainers fixed the vulnerability in version 0.44.0. The patch removes the override of Tornado's validate_absolute_path() checks and enforces that resolved file paths remain within the configured media directory. Patch details and the full advisory are available in the motionEye GitHub Security Advisory.

Workarounds

If immediate patching is not possible, block external access to motionEye media handler endpoints at the network or reverse-proxy layer.
Add reverse-proxy rules that reject requests where the filename parameter contains /, \, or URL-encoded path separators.
Confine the motionEye process using filesystem sandboxing such as systemd ProtectSystem=strict and ReadOnlyPaths= to limit reachable files.

bash

# Example systemd hardening for the motionEye service
[Service]
User=motioneye
Group=motioneye
ProtectSystem=strict
ProtectHome=true
PrivateTmp=true
ReadWritePaths=/var/lib/motioneye
NoNewPrivileges=true