CVE-2025-11607CWE-22path-traversal

CVE-2025-11607

Medium · published October 11, 2025

CVSS v3.1
6.3
EPSS
0%
Percentile
38.1
In the wild
Unconfirmed
What it is

A weakness has been identified in harry0703 MoneyPrinterTurbo up to 1.2.6. The impacted element is the function upload_music of the file app/controllers/v1/music.py of the component API Endpoint. Executing a manipulation of the argument File can lead to path traversal. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00450 · 38.1th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2025-10-11T21:15Z
Affected products (1)
ProductVersionsFixed in
harry0703/moneyprinterturbo≤ 1.2.6—
References (5)
https://vuldb.com/?ctiid.327929 · [email protected]https://vuldb.com/?id.327929 · [email protected]https://vuldb.com/?submit.672550 · [email protected]https://www.notion.so/Arbitrary-File-Write-Vulnerability-in-MoneyPrinterTurbo-1-2-6-288014c4d9ca809bb411e4fe875d1e22 · [email protected]https://www.notion.so/Arbitrary-File-Write-Vulnerability-in-MoneyPrinterTurbo-1-2-6-288014c4d9ca809bb411e4fe875d1e22 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 11 OCT 16:32Z
    harry0703 MoneyPrinterTurbo API Endpoint music.py upload_music path traversal
    cvelistv5