PT-2025-41693 · Unknown · Moneyprinterturbo

Harry0703 + 1 · Published 2025-10-11 · Updated 2025-11-21 · CVE-2025-11607

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions harry0703 MoneyPrinterTurbo versions through 1.2.6

Description A flaw exists in the upload music function within the app/controllers/v1/music.py file of the API Endpoint component. Manipulation of the File argument can result in path traversal. This issue is remotely exploitable and details about the exploit are publicly available.

Recommendations Versions prior to 1.2.6 are affected. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-11607

Affected Products

Moneyprinterturbo

References · 11

• 🔥 https://notion.so/Arbitrary-File-Write-Vulnerability-in-MoneyPrinterTurbo-1-2-6-288014c4d9ca809bb411e4fe875d1e22 · Exploit
• https://osv.dev/vulnerability/CVE-2025-11607 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-11607 · Security Note
• https://vuldb.com/?submit.672550 · Note
• https://t.me/CVEtracker/34686 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1977101277298405449 · Twitter Post
• https://vuldb.com/?ctiid.327929 · Note
• https://t.me/cveNotify/138354 · Telegram Post
• https://t.me/cveNotify/143567 · Telegram Post
• https://twitter.com/CVEnew/status/1977054218940002563 · Twitter Post
• https://vuldb.com/?id.327929 · Note