The vulnerability arises in motionEye’s picture and movie preview endpoints where the filename parameter is not sanitized for path traversal sequences. An authenticated user with normal, non‑admin privileges can request URLs such as /picture/1/preview/../../../../etc/passwd to read any filesystem file that the motionEye process can access. The data exposed may include system files (e.g., /etc/passwd, /etc/shadow), motionEye configuration files containing password hashes or plaintext passwords, SSH keys, and surveillance footage from other cameras. This leads to confidentiality compromise and the potential theft of credentials or sensitive media.

motionEye Project’s motioneye application, versions prior to 0.44.0, is affected. All installations of the motioneye software that have not applied the 0.44.0 release are vulnerable.

The CVSS score of 6.5 indicates moderate severity. The EPSS score is not available, so the precise exploitation probability is unclear. The vulnerability is not listed in CISA KEV. Although authentication is required, normal users have sufficient rights to trigger the exploit, making the threat surface wide. An attacker can read arbitrary files that the motionEye process can access, potentially exposing credentials and private data.