A flaw in motionEye’s media file handlers lets an attacker provide an arbitrary file name, which the application joins into a path without proper validation. By using an absolute path in the filename, the handler ignores the configured media directory and returns the attacker‑supplied path directly. The application then bypasses Tornado’s path safety checks, allowing an attacker to read any file that the motionEye process can access. This results in disclosure of sensitive files, system logs, configuration data, or other confidential information, compromising confidentiality and potentially enabling further attacks. The weakness is an absolute path traversal, mapping to CWE‑22.

All motionEye installations running a version before 0.44.0 are affected. The vendor product is motioneye‑project:motioneye, with the patch introduced in 0.44.0. Version 0.44.0 and later contain the fix, removing the unsafe concatenation of filenames.

The vulnerability has a CVSS score of 7.7, indicating a high severity. The EPSS score is not available, and the flaw is not currently listed in the CISA KEV catalog, suggesting no public exploitation yet. However, because the vulnerable code is exposed via HTTP media file handler endpoints, a remote attacker who can reach the motionEye web interface can craft a request with an absolute path filename to read arbitrary files, provided the process has the necessary filesystem permissions.