CVE-2025-11607
📋 TL;DR
A path traversal vulnerability in MoneyPrinterTurbo's API endpoint allows attackers to write arbitrary files to the server filesystem by manipulating file upload parameters. This affects all MoneyPrinterTurbo instances up to version 1.2.6 with the vulnerable API endpoint exposed. Remote attackers can potentially overwrite critical system files or deploy malicious payloads.
💻 Affected Systems
- harry0703 MoneyPrinterTurbo
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise via arbitrary file write leading to remote code execution, data destruction, or backdoor installation.
Likely Case
Unauthorized file writes to web directories allowing web shell deployment, configuration file modification, or data exfiltration.
If Mitigated
Limited impact with proper file permission restrictions and input validation preventing traversal beyond allowed directories.
🎯 Exploit Status
Public exploit available, remote exploitation without authentication, simple path traversal attack.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.2.7 or later
Vendor Advisory: https://github.com/harry0703/MoneyPrinterTurbo/releases
Restart Required: No
Instructions:
1. Update MoneyPrinterTurbo to version 1.2.7 or later. 2. Replace the vulnerable app/controllers/v1/music.py file. 3. No service restart required for Python applications.
🔧 Temporary Workarounds
Disable vulnerable API endpoint
allTemporarily disable or block access to the /api/v1/music/upload endpoint
# Configure web server (nginx example)
location /api/v1/music/upload { deny all; }
# Or modify application routing to disable the endpoint
Implement input validation middleware
allAdd path traversal validation before file upload processing
# Python example: Validate filename
import os
filename = sanitize_filename(uploaded_file.filename)
if '..' in filename or filename.startswith('/'):
raise ValueError('Invalid filename')
🧯 If You Can't Patch
- Implement strict file permission restrictions on web server directories
- Deploy WAF rules to block path traversal patterns in file upload requests
🔍 How to Verify
Check if Vulnerable:
Check if MoneyPrinterTurbo version is 1.2.6 or earlier and the /api/v1/music/upload endpoint is accessible.Check Version:
Check package.json or application metadata for version, or examine git tags if installed from source.Verify Fix Applied:
Verify version is 1.2.7 or later and test file upload with path traversal attempts returns error.📡 Detection & Monitoring
Log Indicators:
- Unusual file write operations outside expected directories
- API requests to /api/v1/music/upload with filenames containing '..' or '/' characters
- Error logs showing path traversal attempts
Network Indicators:
- HTTP POST requests to upload endpoints with suspicious filename parameters
- Unusual outbound connections following file uploads
SIEM Query:
source="web_logs" AND (uri_path="/api/v1/music/upload" AND (filename="*..*" OR filename="*/*"))🔗 References
- https://vuldb.com/?ctiid.327929
- https://vuldb.com/?id.327929
- https://vuldb.com/?submit.672550
- https://www.notion.so/Arbitrary-File-Write-Vulnerability-in-MoneyPrinterTurbo-1-2-6-288014c4d9ca809bb411e4fe875d1e22
- https://www.notion.so/Arbitrary-File-Write-Vulnerability-in-MoneyPrinterTurbo-1-2-6-288014c4d9ca809bb411e4fe875d1e22
