PT-2026-1360 · Unknown · Pterodactyl

Published 2026-01-06 · Updated 2026-01-17 · CVE-2025-68954

Positive Technologies (AI Summary)

CVSS v4.0

7.5

High

Base vector

AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Pterodactyl versions prior to 1.12.0

Description Pterodactyl, a game server management panel, does not terminate existing SFTP connections when a user's access is revoked or their permissions are modified. Specifically, if a user is connected to SFTP at the time their permissions are changed or they are removed from a server instance, their SFTP connection remains active, allowing continued file access despite the revoked permissions. This issue requires a user to be actively connected to SFTP during the permission change or removal to be exploited.

Recommendations Versions prior to 1.12.0 should be updated to version 1.12.0 or later.

Exploit

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

CVE-2025-68954

GHSA-8C39-XPPG-479C

GO-2026-4283

SUSE-SU-2026:0142-1

Affected Products

Pterodactyl

References · 44

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68954.json · Exploit
• https://github.com/pterodactyl/panel/commit/2bd9d8baddb0e0606e4a9d5be402f48678ac88d5 · Patch
• https://github.com/pterodactyl/panel/security/advisories/GHSA-8c39-xppg-479c · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4283 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0142-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-68954 · Security Note
• https://osv.dev/vulnerability/CVE-2025-68954 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8c39-xppg-479c · Vendor Advisory
• https://github.com/pterodactyl/panel · Note
• https://github.com/pterodactyl/panel/releases/tag/v1.12.0 · Note
• https://suse.com/security/cve/CVE-2025-15107 · Note
• https://suse.com/security/cve/CVE-2025-68151 · Note
• https://suse.com/security/cve/CVE-2026-21483 · Note
• https://suse.com/security/cve/CVE-2026-21885 · Note
• https://suse.com/security/cve/CVE-2017-18896 · Note