Description
Pterodactyl is a free, open-source game server management panel. Prior to version 1.11.11, using the /locales/locale.json with the locale and namespace query parameters, a malicious actor is able to execute arbitrary code without being authenticated. With the ability to execute arbitrary code it could be used to gain access to the Panel's server, read credentials from the Panel's config, extract sensitive information from the database, access files of servers managed by the panel, etc. This issue has been patched in version 1.11.11. There are no software workarounds for this vulnerability, but use of an external Web Application Firewall (WAF) could help mitigate this attack.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| pterodactyl | panel | < 1.11.11 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
Pterodactyl Panel CVE-2025-49132 Remote Code Execution
exploit/linux/http/pterodactyl_locales_locale_json
Exploit-DB 1
- Pterodactyl Panel 1.11.11 - Remote Code Execution (RCE) EDB-52341 · webapps · Jun 26, 2025
GitHub 27 repositories · most starred shown
-
YoyoChaud/CVE-2025-49132 ★ 25 · Feb 8, 2026
Exploit for Pterodactyl Panel ≤ 1.11.10 - unauthenticated LFI to RCE.
-
Zen-kun04/CVE-2025-49132 ★ 16 · Jun 22, 2025
A script that gives you the credentials of a Pterodactyl panel vulnerable to CVE-2025-49132
-
malw0re/CVE-2025-49132-Mods ★ 12 · Feb 8, 2026
-
str1keboo/CVE-2025-49132 ★ 5 · Feb 7, 2026
This repository contains a Proof of Concept (PoC) for CVE-2025-49132, a critical vulnerability in Pterodactyl Panel versions < 1.11.11.
-
63square/CVE-2025-49132 ★ 5 · Jun 24, 2025
PoCs for CVE-2025-49132
-
popyue/CVE-2025-49132 ★ 4 · Feb 16, 2026
CVE For Pterodactyl (For Study and Education)
-
rippsec/CVE-2025-49132-PHP-PEAR ★ 4 · Feb 12, 2026
CVE-2025-49132_PHP_PEAR_METHOD
-
qiaojojo/CVE-2025-49132_poc ★ 4 · Jun 23, 2025
Pterodactyl翼龙面板CVE-2025-49132批量检测☝️🤓
-
GRodolphe/CVE-2025-49132_poc ★ 3 · Aug 18, 2025
This is an improved version of the CVE-2025-49132 proof of concept exploit.
-
0xtensho/CVE-2025-49132-poc ★ 3 · Jul 8, 2025
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Pterodactyl Panel - Remote Code Execution http/cves/2025/CVE-2025-49132.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | pterodactyl/panel | < 1.11.11 | 1.11.11 | GHSA-24wv-6c99-f843 |