Advisory Database Sync

Author: advisory-database[bot]

advisories/github-reviewed/2026/06/GHSA-rw9q-97r9-8gvh/GHSA-rw9q-97r9-8gvh.json

@@ -0,0 +1,52 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-rw9q-97r9-8gvh",
+  "modified": "2026-06-23T18:32:46Z",
+  "published": "2026-06-23T18:32:46Z",
+  "aliases": [
+    "CVE-2026-55488"
+  ],
+  "summary": "motionEye's Absolute Path Traversal in Media File Handlers Allows Arbitrary File Read",
+  "details": "### Summary\n\nmEye contains an absolute path traversal vulnerability in multiple media file handlers that allows an attacker to read arbitrary files from the filesystem.\n\nThe affected handlers accept a user-controlled filename parameter and construct filesystem paths using `os.path.join()`. When an absolute path is supplied, Python discards the configured media directory and returns the attacker-supplied path directly. The application then bypasses Tornado's built-in path validation by overriding the relevant safety checks.\n\nAs a result, an attacker can access files outside of the configured camera media directory, subject to the permissions of the motionEye process.\n\n### Details\n\nThe issue exists in the media playback and download functionality.\n\nThe filename parameter is passed to `mediafiles.get_media_path()`:\n\n```python\ndef get_media_path(camera_config, path, media_type):\n    target_dir = camera_config.get('target_dir')\n    full_path = os.path.join(target_dir, path)\n    return full_path\n```\n\nWhen path is an absolute path (e.g. `/etc/motioneye/motion.conf`), Python's `os.path.join()` discards `target_dir` entirely and returns the absolute path as-is. This would normally be caught by Tornado's StaticFileHandler path validation, but MoviePlaybackHandler explicitly overrides both safety checks (`movie_playback.py` lines 111-115):\n\n```\ndef get_absolute_path(self, root, path):\n    return path\n\ndef validate_absolute_path(self, root, absolute_path):\n    return absolute_path\n```\nThis allows reading any file on the filesystem that the motionEye process can access.\n\nThe same path traversal exists in the movie download, picture download, and picture preview handlers:\n\n- GET /movie/<camera_id>/download/<filename>\n- GET /picture/<camera_id>/download/<filename>\n- GET /picture/<camera_id>/preview/<filename>\n\n# PoC\n\n```\nGET /movie/1/playback//etc/motioneye/motion.conf HTTP/1.1\nHost: target:8765\n```\n\n# Fix\n\nDo not allow absolute paths supplied by user input.\n\nValidate that the fully resolved canonical path remains within the configured camera media directory before serving a file.\n\nAdditionally, Tornado’s built-in path validation should not be bypassed unless equivalent validation is performed by motionEye.",
+  "severity": [],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "PyPI",
+        "name": "motioneye"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "0.44.0"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/motioneye-project/motioneye/security/advisories/GHSA-rw9q-97r9-8gvh"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/motioneye-project/motioneye"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-22"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": true,
+    "github_reviewed_at": "2026-06-23T18:32:46Z",
+    "nvd_published_at": null
+  }
+}

advisories/unreviewed/2022/05/GHSA-585f-rvf9-f227/GHSA-585f-rvf9-f227.json

@@ -1,13 +1,18 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-585f-rvf9-f227",
-  "modified": "2022-05-14T02:15:16Z",
+  "modified": "2026-06-23T18:31:29Z",
   "published": "2022-05-14T02:15:16Z",
   "aliases": [
     "CVE-2011-0627"
   ],
   "details": "Adobe Flash Player before 10.3.181.14 on Windows, Mac OS X, Linux, and Solaris and before 10.3.185.21 on Android allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted Flash content, as possibly exploited in the wild in May 2011 by a Microsoft Office document with an embedded .swf file.",
-  "severity": [],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
+    }
+  ],
   "affected": [],
   "references": [
     {

advisories/unreviewed/2022/08/GHSA-8pp6-vxq4-65qv/GHSA-8pp6-vxq4-65qv.json

@@ -26,7 +26,8 @@
   ],
   "database_specific": {
     "cwe_ids": [
-      "CWE-79"
+      "CWE-79",
+      "CWE-80"
     ],
     "severity": "MODERATE",
     "github_reviewed": false,

advisories/unreviewed/2022/08/GHSA-q5m8-g27f-797h/GHSA-q5m8-g27f-797h.json

@@ -26,6 +26,7 @@
   ],
   "database_specific": {
     "cwe_ids": [
+      "CWE-284",
       "CWE-732"
     ],
     "severity": "MODERATE",

advisories/unreviewed/2023/05/GHSA-m4x7-w6vx-j9fm/GHSA-m4x7-w6vx-j9fm.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-m4x7-w6vx-j9fm",
-  "modified": "2023-05-09T18:30:38Z",
+  "modified": "2026-06-23T18:31:30Z",
   "published": "2023-05-09T18:30:38Z",
   "aliases": [
     "CVE-2023-2609"

advisories/unreviewed/2023/09/GHSA-2rh9-r44r-2xv6/GHSA-2rh9-r44r-2xv6.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-2rh9-r44r-2xv6",
-  "modified": "2023-09-04T15:30:38Z",
+  "modified": "2026-06-23T18:31:30Z",
   "published": "2023-09-04T15:30:38Z",
   "aliases": [
     "CVE-2023-4733"

advisories/unreviewed/2023/09/GHSA-ph6h-mvrc-7rq5/GHSA-ph6h-mvrc-7rq5.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-ph6h-mvrc-7rq5",
-  "modified": "2023-09-04T15:30:38Z",
+  "modified": "2026-06-23T18:31:30Z",
   "published": "2023-09-04T15:30:38Z",
   "aliases": [
     "CVE-2023-4750"

advisories/unreviewed/2023/09/GHSA-qjp4-g2mq-4r5w/GHSA-qjp4-g2mq-4r5w.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-qjp4-g2mq-4r5w",
-  "modified": "2023-11-27T15:30:54Z",
+  "modified": "2026-06-23T18:31:30Z",
   "published": "2023-09-14T21:30:26Z",
   "aliases": [
     "CVE-2023-32611"

advisories/unreviewed/2026/03/GHSA-55gq-23mv-cw8r/GHSA-55gq-23mv-cw8r.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-55gq-23mv-cw8r",
-  "modified": "2026-03-12T18:30:30Z",
+  "modified": "2026-06-23T18:31:31Z",
   "published": "2026-03-11T18:30:32Z",
   "aliases": [
     "CVE-2025-67038"
@@ -19,6 +19,10 @@
       "type": "ADVISORY",
       "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-67038"
     },
+    {
+      "type": "WEB",
+      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-67038"
+    },
     {
       "type": "WEB",
       "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-069-02"

advisories/unreviewed/2026/04/GHSA-7fjh-cgxv-cjc6/GHSA-7fjh-cgxv-cjc6.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-7fjh-cgxv-cjc6",
-  "modified": "2026-06-09T18:30:34Z",
+  "modified": "2026-06-23T18:31:31Z",
   "published": "2026-04-08T18:34:08Z",
   "aliases": [
     "CVE-2026-32589"
@@ -47,6 +47,10 @@
       "type": "WEB",
       "url": "https://access.redhat.com/errata/RHSA-2026:24853"
     },
+    {
+      "type": "WEB",
+      "url": "https://access.redhat.com/errata/RHSA-2026:28441"
+    },
     {
       "type": "WEB",
       "url": "https://access.redhat.com/security/cve/CVE-2026-32589"