Description
wangxutech MoneyPrinterTurbo 1.2.6 allows path traversal via /api/v1/download/ URIs such as /api/v1/download//etc/passwd.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | moneyprinterturbo | <= 1.2.6 | — | PYSEC-2025-143 |
Medium · 6.3
CVE-2025-49089
EUVD-2025-29212GHSA-p63x-hq5f-7f58PYSEC-2025-143
wangxutech MoneyPrinterTurbo 1.2.6 allows path traversal via /api/v1/download/ URIs such as /api/v1/download//etc/passwd.
Published Sep 15, 2025 · Updated Sep 15, 2025 · Assigned by mitre