CVE-2026-31978 is a path traversal vulnerability (CWE-22) in motionEye, an online interface for motion detection software. Versions before 0.44.0 do not properly validate the filename parameter in API endpoints like /picture/{id}/preview/{filename}, allowing authenticated non-admin users to read arbitrary files on the server. The vulnerability exists because functions such as get_media_preview() fail to check for directory traversal sequences, enabling access to sensitive files including system files and other users' surveillance footage. The issue was resolved in version 0.44.0.

An authenticated user with normal privileges can exploit this vulnerability to read arbitrary files on the server filesystem as the motionEye process user. This can lead to disclosure of sensitive information such as system password files (/etc/passwd, /etc/shadow), motionEye configuration files containing password hashes and plaintext passwords, SSH keys, and surveillance footage from other cameras. There is no impact on integrity or availability reported.

Upgrade motionEye to version 0.44.0 or later, where this path traversal vulnerability has been fixed. Until the upgrade is applied, restrict access to the affected API endpoints to trusted users only. Patch status is confirmed fixed in 0.44.0.