CVE-2025-7895 is a medium (CVSS 6.3) unrestricted file upload in harry0703 MoneyPrinterTurbo (MoneyPrinterTurbo up to 1.2.6). The record names no fixed version, so plan on isolating or replacing it. Do not expose the product to untrusted networks until you have confirmed a fix.
What's affected
The record lists MoneyPrinterTurbo up to 1.2.6 as affected. The vulnerable code is in app/controllers/v1/video.py (function upload_bgm_file), through the File argument.
No fixed version is named in the record. Check the project's releases for anything newer than 1.2.6.
The record places the flaw in the file extension handler of the background music upload endpoint.
The record's CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, a score of 6.3. The VulDB page the record links returned an access error, so this post relies on the NVD record.
The record's kev flag is false, so the CVE is not in CISA's Known Exploited Vulnerabilities catalog at the time of this review.
How to check if you're exposed
Find out whether the component is deployed in your estate. These products often arrive inside a larger system, so check your server inventory and your web application directories:
find / -name "video.py" -not -path "/proc/*" 2>/dev/null | head
Then check your web server or reverse proxy logs for requests to that path from addresses you do not recognize.
For upload flaws, also look at the upload storage directory for files with script extensions that you did not put there.
A free in-browser dependency scan at gold.safeguard.sh/scan can show whether this CVE appears in a project's dependency list. Note that it covers packages. Stand-alone applications and firmware are best checked against your own inventory.
What to do now
- Confirm whether you run MoneyPrinterTurbo and in which version.
- Block the upload endpoint at the web server or WAF until a fix exists.
- Make sure uploaded files cannot be executed: store them outside the web root, or disable script handling in the upload directory.
- Search the upload directory for files with script extensions and review anything unexpected.
- Check the project's releases for a newer release, and restrict the product to authenticated users on a trusted network.
If you maintain a codebase and want to know whether a vulnerable package is actually called, Safeguard's reachability analysis separates packages that are present from code paths that are used.
Why it matters
The weakness class here is CWE-284 (improper access control), CWE-434 (unrestricted upload of a dangerous file type). When an application stores a file with its original extension in a place the web server will execute, an upload becomes a way to run code. The standard defenses are an allow list of file types, a server generated name, storage outside the web root and no script execution in the upload folder.
Quick check
Is there a patch for CVE-2025-7895?
The record does not name a fixed version, and for PAD CMS CERT Polska says none will be published. Treat the product as unpatched, reduce its exposure and check the vendor or project site for news.
Is CVE-2025-7895 being exploited in the wild?
The record's kev flag is false, so it is not in CISA's Known Exploited Vulnerabilities catalog. No advisory I read says it is being exploited.
Sources
- Safeguard Gold entry for CVE-2025-7895
- VulDB entry 317010 listed in the record (listed in the record, not retrievable when reviewed)
- NVD record data for CVE-2025-7895, published 2025-07-20, source cna@vuldb.com
Last reviewed: 18 October 2026.
