Vulnerability · Published Sep 15, 2025 · Assigned by VulDB

CVE-2025-10472harry0703 MoneyPrinterTurbo URL video.py stream_video path traversal

Medium 5.3

In plain English

A medium-severity path traversal in MoneyPrinterTurbo from harry0703. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.8%top 41.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability has been found in harry0703 MoneyPrinterTurbo up to 1.2.6. The impacted element is the function download_video/stream_video of the file app/controllers/v1/video.py of the component URL Handler. The manipulation of the argument file_path leads to path traversal. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

Affected products (as reported)

Vendor	Product	Versions
harry0703	MoneyPrinterTurbo	1.2.01.2.11.2.21.2.31.2.41.2.51.2.6

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R

References

VDB-323892 | harry0703 MoneyPrinterTurbo URL video.py stream_video path traversal vdb-entry, technical-description
VDB-323892 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #648393 | MoneyPrinterTurbo project MoneyPrinterTurbo 1.2.6 Absolute Path Traversal third-party-advisory
https://www.notion.so/Path-Traversal-Vulnerability-in-MoneyPrinterTurbo-1-2-6-265014c4d9ca80e38da4deaeee8b46f5?source=copy_link exploit
https://www.notion.so/Path-Traversal-Vulnerability-in-MoneyPrinterTurbo-1-2-6-265014c4d9ca80e38da4deaeee8b46f5 exploit