MotionEye versions prior to 0.43.1b5 contain a command injection vulnerability in the handling of certain configuration parameters via the Web UI. Unsanitized user input in fields like image_file_name and movie_filename is written directly into Motion configuration files and interpreted by the shell when the Motion service restarts. This allows authenticated attackers with high privileges to execute arbitrary commands inside the MotionEye container, potentially leading to full container and host compromise depending on container privileges. Client-side validation attempts to block malicious input but can be bypassed via browser console manipulation. A fix is available in version 0.43.1b5.