CVE-2026-31978

🗓️ 24 Jun 2026 20:28:24Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 15 Views🌐 WEB

Authenticated users can read arbitrary files via path traversal in motionEye picture and movie previews before version 0.44.0.

Reporter	Title	Published	Views	Family All 11
attackerkb	CVE-2026-31978	24 Jun 202620:28	–	attackerkb
circl	CVE-2026-31978	20 Jun 202616:47	–	circl
cvelist	CVE-2026-31978 motionEye: Arbitrary File Read via Path Traversal in Picture/Movie Preview Endpoint	24 Jun 202620:28	–	cvelist
euvd	EUVD-2026-39078	24 Jun 202620:28	–	euvd
github	motionEye has an Arbitrary File Read via Path Traversal in Picture/Movie Preview Endpoint	22 Jun 202617:10	–	github
nvd	CVE-2026-31978	24 Jun 202621:16	–	nvd
osv	CVE-2026-31978 motionEye: Arbitrary File Read via Path Traversal in Picture/Movie Preview Endpoint	24 Jun 202620:28	–	osv
osv	GHSA-G9FX-5R4H-PCW3 motionEye has an Arbitrary File Read via Path Traversal in Picture/Movie Preview Endpoint	22 Jun 202617:10	–	osv
ptsecurity	PT-2026-51430	22 Jun 202600:00	–	ptsecurity
snyk	Access Control Bypass	22 Jun 202617:10	–	snyk

Vulners

Node

motioneye-project motioneyeRange<0.44.0

[
  {
    "vendor": "motioneye-project",
    "product": "motioneye",
    "versions": [
      {
        "version": "< 0.44.0",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/motioneye-project/motioneye/releases/tag/0.44.0
github	www.github.com/motioneye-project/motioneye/security/advisories/GHSA-g9fx-5r4h-pcw3

Parameter	Position	Path	Description	CWE
filename	path	/picture/{id}/preview/{filename}	Path traversal vulnerability in picture API allows reading arbitrary files via filename parameter without proper validation	CWE-284, CWE-22

25 Jun 2026 23:17Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.16.5

EPSS0.00418

SSVC