motionEye patch: RCE, unauthorized API access, path traversal fixes (CVE-2026-xxx)

Vulnerability Overview CVE-2026-46488 CVE-2026-55863 CVE-2026-32315 CVE-2026-31978 CVE-2026-55488 The combination of these vulnerabilities allows attackers to perform various attacks; each step has been mitigated. Impact Scope CVE-2026-46488 and CVE-2026-31978: Involves path traversal vulnerabilities that could lead to unauthorized access to sensitive files. CVE-2026-55863: Involves API authentication issues that could lead to unauthorized access to the API. CVE-2026-32315: Involves configuration file read permission issues that could lead to sensitive information leakage. CVE-2026-55488: Involves input validation issues that could lead to command injection or other security vulnerabilities. Remediation 1. Path Traversal Vulnerabilities (CVE-2026-46488 and CVE-2026-31978) - Any file or directory paths passed via API requests or internally that contain path traversal elements now return a 403 response or exception, respectively. - Fix Code: 2. API Authentication Issues (CVE-2026-55863) - The signature authentication method has been replaced with session cookies. When using the API, a session cookie must be obtained by sending a POST request to the API endpoint, using and as POST data parameters. If the credentials are correct, a session cookie is returned, which must be sent with subsequent API requests. - Fix Code: 3. Configuration File Read Permission Issues (CVE-2026-32315) - Configuration files are now created and stored with UNIX mode to prevent read access by anyone other than the motionEye daemon user and root. - Fix Code: 4. Input Validation Issues (CVE-2026-55488) - Backend input path validation has been extended to prevent any kind of escaping the camera data directory. - Fix Code: Other Important Updates Session Cookie Authentication: API authentication now uses session cookies, replacing the previous signature authentication method. HMAC Authentication: HMAC authentication has been added for remote motionEye cameras. A signature is generated using a shared secret key, the request URL, a nonce, and a timestamp. Removal of HTTP Basic Authentication: The HTTP basic authentication option has been removed. Forced Password Encryption: All user passwords are now forcibly stored using Argon2 hashing. SHA1 hashing and plaintext passwords are still usable but will be automatically migrated upon login. action API Authentication: The action API now requires authentication. S3 Upload Improvements: S3 uploads now support filenames with and without path elements, and the "Include Subdirectories" slider now functions as intended. Exception Handling: Cases where remote motionEye instances do not respond to HTTP requests are now handled correctly. SSE-C Server-Side Encryption: Base64-encoded keys are defined. Camera Tags: Cameras can now be tagged as admin-only visible, hiding them from the normal/monitoring user GUI. Accessing their API requires admin credentials. picture/ID/current API Fix: Fixed an issue where the parameter (default 10 seconds) was not included in requests. Python 3.14 Compatibility: Fixed. Camera Streaming Access: Fixed access to camera streaming via digest authentication. Streaming Access: Streaming access no longer automatically uses normal/monitoring user credentials; a username and password must be entered individually for each streaming camera. CI/CD Testing: CI/CD tests have been hardened and expanded, applying certain coding standards and type checking. Frontend Cleanup: Significant frontend cleanup performed: outdated scripts removed, all other scripts updated, scripts updated or switched to vanilla JavaScript, and some frontend input validators merged to reduce the number of event listeners. RTSP Webcam Passwords: Passwords and usernames containing special characters no longer cause authentication issues. Configuration File Permissions: Configuration files are now created and stored with UNIX mode . Path Traversal Protection: Any file or directory paths passed via API requests or internally that contain path traversal elements now return a 403 response or exception. Input Path Validation: Backend input path validation has been extended to prevent any kind of escaping the camera data directory. Backup Restore Limitations: Backup restore functionality is limited to configuration files actually generated by the web interface, such as , , , and . Older backups created from the console (such as and camera action scripts) are not included and will no longer be restored. New Camera Credentials Change Dialog: Added new buttons and dialogs to change webcam credentials, including simple MJPEG cameras and remote motionEye cameras. If connection to a remote motionEye camera fails, the dialog automatically pops up, simplifying the application of new remote/client keys. Password Change Issues: Resolved an issue where manual input into the field was required when changing passwords in the settings panel, such as when auto-filled by a password manager. Camera Placeholder Icon: Fixed the aspect ratio

Goal Reached Thanks to every supporter — we hit 100%!

motionEye patch: RCE, unauthorized API access, path traversal fixes (CVE-2026-xxx)

More from this source