CVE Tools
Sign in

CVE-2025-49132

Pterodactyl Panel Allows Unauthenticated Arbitrary Remote Code Execution

Published: Jun 20, 2025Updated: Jun 23, 2025 Sources: CVE List NVD GHSACWE-94
10.0CRITICAL
NVD MITRE
EPSS Score
53.4%
Top 1.1%
CISA KEV
Not in KEV
Exploits
No Known Exploits
Remediation
Patch Available
Self-Check
Nuclei

Description

Pterodactyl is a free, open-source game server management panel. Prior to version 1.11.11, using the /locales/locale.json with the locale and namespace query parameters, a malicious actor is able to execute arbitrary code without being authenticated. With the ability to execute arbitrary code it could be used to gain access to the Panel's server, read credentials from the Panel's config, extract sensitive information from the database, access files of servers managed by the panel, etc. This issue has been patched in version 1.11.11. There are no software workarounds for this vulnerability, but use of an external Web Application Firewall (WAF) could help mitigate this attack.

No summary for this CVE yet.

CVSS Vector Breakdown

AV:NAC:LPR:NUI:NS:CC:HI:HA:H
Exploitability
AV:NAttack Vector
Network
AC:LAttack Complexity
Low
PR:NPrivileges Required
None
UI:NUser Interaction
None
Scope
S:CScope
Changed
Impact
C:HConfidentiality
High
I:HIntegrity
High
A:HAvailability
High
Open in CVSS calculator →

Weaknesses

CWE-94

Affected Products

pterodactyl
oss-projectaka pterodactyl panel, pterodactyl/wings
panelMixed
Cloud & SaaS / saas-application
Packagist
package-ecosystem
pterodactyl/panel
OSS Libraries

Exploitability

Official Patch Available
Is your org exposed to CVE-2025-49132?We'll check your whole external perimeter for exposure — free. Check my exposure

Attack Graph

Products CVE Techniques Tactics

Click technique nodes for MITRE ATT&CK details · drag to pan · Ctrl/⌘ + scroll to zoom, or go fullscreen.

MITRE ATT&CK

2 techniques
Execution
Initial Access
View detailed technique mapping

References

https://github.com/pterodactyl/panel/security/advisories/GHSA-24wv-6c99-f843
github.com
https://github.com/pterodactyl/panel/commit/24c82b0e335fb5d7a844226b08abf9f176e592f0
github.com
https://github.com/pterodactyl/panel/releases/tag/v1.11.11
github.com
and 2 more references View all →
News mentions
1

Unlock Complete Vulnerability Intelligence

Get the full picture for CVE-2025-49132 and every CVE in our database. Create a free account — no credit card required.

Create Free Account
Plain-language analysis
Impact assessment and exploitation scenario in plain English
Attack graph visualization
Interactive attack path and kill chain mapping
Exploit details & PoC links
ExploitDB, Metasploit, GitHub PoCs with direct links
Nuclei scanner templates
Ready-to-use vulnerability scanner templates
Full remediation guide
Patch instructions, workarounds, and compliance impact
Interactive AI chat
Ask questions about this vulnerability in natural language
Related vulnerabilities
Semantically similar CVEs and attack patterns
REST API & MCP access
Integrate vulnerability data into your workflows