---
title: "GHSA-qxvg-h7q2-hcxh: motionEye: LFI → pass‑the‑hash admin → unsafe restore → unauth action exec (RCE)"
url: https://erroneo.us/security/ghsa/GHSA-qxvg-h7q2-hcxh/
description: "GHSA-qxvg-h7q2-hcxh (critical, PyPI): motionEye: LFI → pass‑the‑hash admin → unsafe restore → unauth action exec (RCE). Summary A multi‑stage chain in…"
type: advisory
section: "Security Digest"
date_published: 2026-06-23
date_modified: 2026-06-23
publisher: erroneo.us
author: erroneo.us Security Desk
ghsa: "GHSA-qxvg-h7q2-hcxh"
license: All rights reserved. Quote with attribution and a link.
---

# GHSA-qxvg-h7q2-hcxh: motionEye: LFI → pass‑the‑hash admin → unsafe restore → unauth action exec (RCE)

## Affected packages

- PyPI `motioneye` < 0.44.0 → fixed: 0.44.0

## Details

Summary A multi‑stage chain in motionEye leads to remote code execution. The chain combines: 1. Arbitrary file read (LFI) via the picture download endpoint for local motion cameras using absolute paths. 2. Pass‑the‑hash admin auth due to accepting request signatures computed with password hashes. 3. Unsafe config restore that extracts attacker‑controlled tarballs into CONFPATH. 4. Unauthenticated action execution via /action/ / . If the normal user password is unset, the chain becomes unauthenticated RCE. If a normal password exists, a normal user can still achieve admin escalation and RCE. --- Affected Code (motionEye repo) 1) LFI (absolute path) — picture/ /download Files: - motioneye/motioneye/handlers/picture.py → download() (local motion camera branch) - motioneye/motioneye/mediafiles.py → getmediacontent() Issue: getmediacontent() only blocks .. and then joins targetdir with path. Absolute paths (e.g. /etc/hosts) bypass the join and are read directly. 2) Pass‑the‑hash admin auth File: motioneye/motioneye/handlers/base.py → getcurrentuser() Issue: The signature check allows signatures computed using the admin password hash (SHA1) as the key. If the hash is leaked (via LFI), admin access can be obtained without the plaintext password. 3) Unsafe restore (tar extraction) File: motioneye/motioneye/config.py → restore() Issue: tar zxC CONFPATH is used on user‑supplied data without sanitizing entries. A crafted tar can drop executable files into CONFPATH. 4) Unauthenticated action execution File: motioneye/motioneye/handlers/action.py → post() Issue: No authentication decorator is present. It executes found in CONFPATH with subprocess.Popen. --- Exploit Chain (Detailed) 1. Create or find a local motion camera id (local motion cameras are required for the vulnerable LFI path). 2. LFI via picture download: - Request: /picture/ /download/ - Example: /picture/1/download/%2Fetc%2Fhosts - Result: Arbitrary file read. 3. Read admin hash from /etc/motioneye/motion.conf: - Contains @adminpassword . 4. Pass‑the‑hash admin: - Compute signature for /config/restore?username=admin using the hash…

## Sources

- [GitHub Advisory GHSA-qxvg-h7q2-hcxh](https://github.com/advisories/GHSA-qxvg-h7q2-hcxh)
- [github.com](https://github.com/motioneye-project/motioneye/security/advisories/GHSA-qxvg-h7q2-hcxh)

---
Source page: https://erroneo.us/security/ghsa/GHSA-qxvg-h7q2-hcxh/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt