PT-2025-26186 · Panel · Panel

Azimoff337 · Published 2025-06-18 · Updated 2025-08-05 · CVE-2025-49132

Positive Technologies · (AI Summary)

CVSS v3.1

10

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions:

Pterodactyl versions prior to 1.11.11

Description:

Pterodactyl is a free, open-source game server management panel. Using the /locales/locale.json with the `locale` and `namespace` query parameters, a malicious actor is able to execute arbitrary code without being authenticated. This could be used to gain access to the Panel's server, read credentials from the Panel's config, extract sensitive information from the database, access files of servers managed by the panel, etc.

Recommendations:

To resolve the issue, update to version 1.11.11 or later. For those running modified versions of the Panel and using Git, apply the patch using `git apply` from https://github.com/pterodactyl/panel/commit/24c82b0e335fb5d7a844226b08abf9f176e592f0.patch. As a temporary workaround, consider using an external Web Application Firewall (WAF) to mitigate the attack, but note that this is not a substitute for patching the software.

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2025-49132

GHSA-24WV-6C99-F843

Affected Products

Panel

References · 14

• https://nvd.nist.gov/vuln/detail/CVE-2025-49132 · Security Note
• https://osv.dev/vulnerability/CVE-2025-49132 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-24wv-6c99-f843 · Vendor Advisory
• https://github.com/pterodactyl/panel/releases/tag/v1.11.11 · Note
• https://github.com/pterodactyl/panel/commit/24c82b0e335fb5d7a844226b08abf9f176e592f0 · Note
• https://github.com/pterodactyl/panel/security/advisories/GHSA-24wv-6c99-f843 · Note
• https://github.com/pterodactyl/panel · Note
• https://reddit.com/r/selfhosted/comments/1lesysp/security_psa_if_youre_hosting_pterodactyl_on_your · Reddit Post
• https://t.me/cvetracker/26677 · Telegram Post
• https://twitter.com/RhinozzCode/status/1935760759109169407 · Twitter Post
• https://twitter.com/CveFindCom/status/1936109261945201074 · Twitter Post
• https://reddit.com/r/admincraft/comments/1lf0v3x/pterodactyl_panel_cvss_100_security_vulnerability · Reddit Post
• https://twitter.com/CVEnew/status/1936110489484116081 · Twitter Post
• https://reddit.com/r/Pterodactyl/comments/1lepwn6/panel_11111_has_been_released_security_update · Reddit Post