CVE-2026-55488 Details
Description
motionEye (mEye) is an online interface for a piece of software called "motion," which is a video surveillance program with motion detection. Versions prior to 0.44.0 contain an absolute path traversal vulnerability in multiple media file handlers that allows an attacker to read arbitrary files from the filesystem. The affected handlers accept a user-controlled filename parameter and construct filesystem paths using `os.path.join()`. When an absolute path is supplied, Python discards the configured media directory and returns the attacker-supplied path directly. The application then bypasses Tornado's built-in path validation by overriding the relevant safety checks. As a result, an attacker can access files outside of the configured camera media directory, subject to the permissions of the motionEye process. Version 0.44.0 fixes the issue.
A path traversal vulnerability has been identified in motionEye versions prior to 0.44.0. The issue arises in multiple media file handlers that process user-controlled filename parameters. These handlers construct filesystem paths using 'os.path.join()'. When an absolute path is provided, Python ignores the designated media directory and returns the absolute path directly. This bypasses Tornado's standard path validation, allowing attackers to access files outside the intended directory, depending on the permissions of the motionEye process.
Users are advised to update to motionEye version 0.44.0 or later, and to ensure that user-supplied paths are validated to remain within the configured camera media directory before serving files.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 24, 2026CISA-ADP
Assessed Jun 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/motioneye-project/motioneye/security/advisories/GHSA-rw9q-97r9-8gvh | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/motioneye-project/motioneye/security/advisories/GHSA-rw9q-97r9-8gvh | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| motionEye | < 0.44.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 24, 2026 | CVE Modified | CISA-ADP |
| Jun 24, 2026 | New CVE Received | [email protected] |