CVE-2026-31978 is a path traversal vulnerability (CWE-22) in motionEye, an online interface for motion detection software. Versions before 0.44.0 do not properly validate the filename parameter in picture and movie API endpoints, allowing authenticated non-admin users to read arbitrary files on the server filesystem as the motionEye process user. The vulnerability exists because functions such as get_media_preview() do not check for '..' sequences in filenames, enabling directory traversal attacks. This can expose sensitive system files, configuration data, and other users' surveillance footage. The vulnerability was fixed in motionEye version 0.44.0.

An authenticated user with normal privileges can read arbitrary files on the server running motionEye, potentially exposing sensitive system files (e.g., /etc/passwd, /etc/shadow), configuration files containing password hashes and plaintext passwords, SSH keys, and other users' surveillance footage. This compromises confidentiality but does not affect integrity or availability. The CVSS 3.1 base score is 6.5 (medium severity), reflecting network attack vector, low attack complexity, required privileges, no user interaction, and high confidentiality impact.

Upgrade motionEye to version 0.44.0 or later, where this path traversal vulnerability has been fixed. No other mitigation is required as the fix addresses the root cause by properly validating filename parameters to prevent directory traversal.