id: PYSEC-2025-143
published: "2025-09-15T17:15:34.623Z"
modified: "2025-10-02T18:49:15.050Z"
aliases:
- CVE-2025-49089
details: wangxutech MoneyPrinterTurbo 1.2.6 allows path traversal via /api/v1/download/ URIs such as /api/v1/download//etc/passwd.
affected:
- package:
    name: moneyprinterturbo
    ecosystem: PyPI
    purl: pkg:pypi/moneyprinterturbo
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - last_affected: 1.2.6
  ecosystem_specific: {}
references:
- type: WEB
  url: https://gist.github.com/Theresasu1/3a9ced1f3d8208cc9f99ce34057cf681
- type: WEB
  url: https://moneyprinterturbo.net
- type: WEB
  url: https://www.wangxutech.com
- type: PACKAGE
  url: https://github.com/harry0703/MoneyPrinterTurbo
severity:
- type: CVSS_V3
  score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L