CVE-2025-11607 | harry0703 MoneyPrinterTurbo up to 1.2.6 API Endpoint music.py upload_music File path traversal

A vulnerability was found in harry0703 MoneyPrinterTurbo up to 1.2.6. It has been declared as critical. The impacted element is the function upload_music of the file app/controllers/v1/music.py of the component API Endpoint. Executing manipulation of the argument File can lead to path traversal.

This vulnerability appears as CVE-2025-11607. The attack may be performed from remote. In addition, an exploit is available.