PT-2025-37739 · Harry0703 · Moneyprinterturbo

Xuansama · Published 2025-09-15 · Updated 2025-11-21 · CVE-2025-10472

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions harry0703 MoneyPrinterTurbo versions through 1.2.6

Description A path traversal vulnerability exists in the download video/stream video function within the app/controllers/v1/video.py file of the URL Handler component. Manipulation of the file path argument can lead to unauthorized access. The attack can be initiated remotely. The exploit has been disclosed to the public.

Recommendations harry0703 MoneyPrinterTurbo versions prior to 1.2.6: Address the path traversal issue by sanitizing or validating the file path argument within the download video/stream video function in app/controllers/v1/video.py.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-10472

Affected Products

Moneyprinterturbo

References · 10

• 🔥 https://notion.so/Path-Traversal-Vulnerability-in-MoneyPrinterTurbo-1-2-6-265014c4d9ca80e38da4deaeee8b46f5 · Exploit
• 🔥 https://notion.so/Path-Traversal-Vulnerability-in-MoneyPrinterTurbo-1-2-6-265014c4d9ca80e38da4deaeee8b46f5?source=copy_link · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-10472 · Security Note
• https://osv.dev/vulnerability/CVE-2025-10472 · Vendor Advisory
• https://vuldb.com/?ctiid.323892 · Note
• https://vuldb.com/?submit.648393 · Note
• https://twitter.com/CVEnew/status/1969292016572887063 · Twitter Post
• https://t.me/cveNotify/143569 · Telegram Post
• https://t.me/CVEtracker/32540 · Telegram Post
• https://vuldb.com/?id.323892 · Note