CVE-2025-49089

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-49089
wangxutech MoneyPrinterTurbo 1.2.6 allows path traversal via /api/v1/download/ URIs such as /api/v1/download//etc/passwd.

6.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References
Link Resource
https://gist.github.com/Theresasu1/3a9ced1f3d8208cc9f99ce34057cf681 Broken Link
https://github.com/harry0703/MoneyPrinterTurbo Product
https://moneyprinterturbo.net Broken Link
https://www.wangxutech.com Product
Configurations

Configuration 1 (hide)

cpe:2.3:a:wangxutech:moneyprinterturbo:1.2.6:*:*:*:*:*:*:*
History

20 Sep 2025, 02:48

Type Values Removed Values Added
First Time Wangxutech
Wangxutech moneyprinterturbo
CPE cpe:2.3:a:wangxutech:moneyprinterturbo:1.2.6:*:*:*:*:*:*:*
References () https://gist.github.com/Theresasu1/3a9ced1f3d8208cc9f99ce34057cf681 - () https://gist.github.com/Theresasu1/3a9ced1f3d8208cc9f99ce34057cf681 - Broken Link
References () https://github.com/harry0703/MoneyPrinterTurbo - () https://github.com/harry0703/MoneyPrinterTurbo - Product
References () https://moneyprinterturbo.net - () https://moneyprinterturbo.net - Broken Link
References () https://www.wangxutech.com - () https://www.wangxutech.com - Product

15 Sep 2025, 19:15

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 6.3
CWE CWE-22

15 Sep 2025, 17:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-09-15 17:15

Updated : 2025-09-20 02:48

NVD link : CVE-2025-49089

Mitre link : CVE-2025-49089

CVE.ORG link : CVE-2025-49089

JSON object : View

Products Affected

wangxutech

  • moneyprinterturbo
CWE
CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')