motionEye is an online interface for motion software, a video surveillance program with motion detection. In all releases prior to 0.44.0, it creates the main configuration file /etc/motioneye/motion.conf and per‑camera camera‑*.conf files with world‑readable 644 permissions, allowing any local user to read them. These files contain sensitive data, such as the SHA1 admin password hash and camera credentials. An attacker who can read the files can crack the hash offline, use it to forge authenticated admin API requests via the signature authentication flaw (GHSA‑45h7‑499j‑7ww3), and chain it with the OS command injection vulnerability (CVE‑2025‑60787) to elevate a local unprivileged user to the Motion daemon user, often root, thereby enabling full system compromise. The issue was fixed in version 0.44.0, which sets proper 600 permissions and removes the exposure.

The vulnerable product is motionEye (motioneye‑project) with all releases prior to version 0.44.0. The configuration files impacted are /etc/motioneye/motion.conf and any per‑camera camera‑*.conf files.

The vulnerability carries a CVSS score of 5.5, indicating moderate severity, and currently has no EPSS score and is not listed in CISA KEV, suggesting a lower likelihood of exploitation at large scales. The attack vector is local; a non‑privileged user who can log into the system can read the files, crack the admin hash offline, and chain this with other local exploits to gain full root access to the motion daemon.