{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"1.2.6"}],"component":"moneyprinterturbo","cve_ids":["CVE-2025-49089"],"ecosystem":"PyPI","epss":0.00311,"exploited":false,"fixed_versions":[],"id":"tcs_01M5KGNV5QJN4C991F56XTZ6F4","modified_at":"2026-05-21T15:00:19.189811315Z","published_at":"2025-09-15T17:15:34.623Z","references":["https://osv.dev/vulnerability/PYSEC-2025-143","https://gist.github.com/Theresasu1/3a9ced1f3d8208cc9f99ce34057cf681","https://moneyprinterturbo.net","https://www.wangxutech.com","https://github.com/harry0703/MoneyPrinterTurbo"],"severity":{"label":"medium","score":6.3},"sources":[{"source":"osv","source_id":"PYSEC-2025-143","url":"https://osv.dev/vulnerability/PYSEC-2025-143"}],"summary":"wangxutech MoneyPrinterTurbo 1.2.6 allows path traversal via /api/v1/download/ URIs such as /api/v1/download//etc/passwd."}