Harry0703 MoneyPrinterTurbo Path Traversal Vulnerability in URL Handler

A path traversal vulnerability has been identified in Harry0703 MoneyPrinterTurbo versions through 1.2.6. The issue arises in the URL Handler component, specifically within the download_video and stream_video functions of the app/controllers/v1/video.py file. The vulnerability allows remote, unauthenticated attackers to manipulate the file_path argument, enabling them to read arbitrary files from the server's filesystem.

Impact

Exploitation of this vulnerability allows for path traversal, where an attacker can access files outside the intended directory, potentially leading to the disclosure of sensitive information.

Reproduction

To reproduce this vulnerability, send a request to the /api/v1/download/ endpoint with a crafted file_path argument that includes traversal sequences. This will bypass the application's input validation and access files on the server's filesystem.