CVE-2025-11607 harry0703 MoneyPrinterTurbo API Endpoint music.py upload_music path traversal

What is CVE-2025-11607?

CVE-2025-11607 is a medium-severity path traversal vulnerability in harry0703 MoneyPrinterTurbo, published on 11 Oct 2025. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A weakness has been identified in harry0703 MoneyPrinterTurbo up to 1.2.6. The impacted element is the function upload_music of the file app/controllers/v1/music.py of the component API Endpoint. Executing a manipulation of the argument File can lead to path traversal. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.

Weakness: CWE-22

Which versions are affected by CVE-2025-11607?

It affects 1 product.

Products include Harry0703 Moneyprinterturbo.

How do I fix CVE-2025-11607?

No fix has been published for CVE-2025-11607 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2025-11607 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-11607 exists.

Other vulnerabilities in harry0703 MoneyPrinterTurbo

• CVE-2025-10472 harry0703 MoneyPrinterTurbo URL video.py stream_video path traversal Medium 6.9
• CVE-2025-7897 harry0703 MoneyPrinterTurbo API Endpoint base.py verify_token missing authentication Medium 6.9
• CVE-2025-49089 Path traversal in n/a Medium 6.3
• CVE-2025-7895 harry0703 MoneyPrinterTurbo File Extension video.py upload_bgm_file unrestricted upload Medium 5.3
• CVE-2025-7896 harry0703 MoneyPrinterTurbo video.py delete_video path traversal Medium 5.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-m6rq-qq7h-r6w6.