CVE-2025-49132

What it actually does

This is an unauthenticated remote code execution flaw in Pterodactyl Panel before version 1.11.11. The vulnerable localization endpoint, /locales/locale.json, accepts locale and namespace query parameters that can be abused to cause server-side code execution. Because exploitation requires no authentication, no user interaction, and can be performed over the network, a successful attacker can execute commands in the context of the web application process, potentially read the Panel configuration, obtain application secrets and database credentials, access managed game server files, modify Panel data, deploy persistence, or disrupt service availability. The issue is rated critical with CVSS 10.0, has weaponized exploit maturity, and has a relatively high EPSS score of 0.53389, indicating meaningful likelihood of exploitation even though it is not currently listed in CISA KEV.

Why it matters to the business

An exposed vulnerable Pterodactyl Panel can be taken over remotely without a valid login. Compromise may lead to theft of administrator credentials, database contents, application secrets, customer or player data, and files belonging to game servers managed through the panel. Attackers could also delete or alter hosted server files, interrupt game hosting operations, pivot from the Panel host into adjacent infrastructure, or use the server for malware, botnet, cryptomining, or further attacks. Because public exploit code is considered weaponized and the vulnerability has been public for over a year, internet-facing deployments should be treated as high-priority remediation targets even though the vulnerability is not currently in KEV and is not known from the provided data to be ransomware-associated.

How an attack unfolds

An attacker first identifies an internet-accessible Pterodactyl Panel and determines whether the /locales/locale.json endpoint is reachable. On vulnerable versions before 1.11.11, the attacker sends a crafted unauthenticated request using the locale and namespace parameters to trigger code execution in the Panel application context. After code execution, the attacker typically verifies command execution, enumerates the filesystem and application runtime, and attempts to read sensitive configuration such as environment files containing application keys, database credentials, cache/session settings, and mail or API secrets. With those secrets, the attacker can access or manipulate the Panel database, create or modify administrative users, steal tokens, access managed server files, and establish persistence through web shells, scheduled tasks, startup services, modified application files, or unauthorized SSH keys. Follow-on activity may include data exfiltration, service disruption, deployment of cryptominers or malware, lateral movement, and cleanup of logs or temporary files.

How to fix it

Upgrade Pterodactyl Panel to version 1.11.11 or later immediately. For source/Git-based deployments, ensure the codebase includes the upstream fix commit ac16af6d0a704c009240f18cfe3b31ca1dc24923. Because the advisory states there are no software workarounds, do not rely on configuration-only mitigations as a substitute for patching. If immediate patching is not possible, temporarily restrict access to the Panel to trusted networks or VPN users, place the application behind a Web Application Firewall with rules for abnormal /locales/locale.json requests, and block unauthenticated public access where operationally feasible. After upgrading, rotate secrets that may have been exposed, including the application key if appropriate, database credentials, API keys, mail credentials, OAuth credentials, and any tokens stored by the application. Review and remove unauthorized administrator accounts, SSH keys, cron jobs, systemd services, web shells, and modified application files. Rebuild from a known-good backup or clean image if there is evidence of successful exploitation.

How to confirm the fix worked

Confirm the deployed Pterodactyl Panel version is 1.11.11 or later, or verify that the deployed Git revision contains commit ac16af6d0a704c009240f18cfe3b31ca1dc24923. Check package, Git, container image, and deployment automation sources to ensure the fixed version is actually running in production rather than only present in a repository. Validate that /locales/locale.json remains reachable only as intended and that requests with unexpected locale or namespace values do not produce server errors, command output, unusual latency, or new application log exceptions. Review web server logs for historical requests to /locales/locale.json with locale= and namespace= parameters, especially requests from unfamiliar IP addresses, high request rates, encoded metacharacters, traversal-like strings, or values inconsistent with normal language/localization usage. After remediation, run an authenticated administrative check of Panel integrity, user accounts, API keys, scheduled jobs, and managed server file access. If exploitation is suspected, perform credential rotation and host forensic review rather than treating the version upgrade alone as sufficient.

Typical attack path

1. Scan for exposed Pterodactyl Panel instances and fingerprint likely vulnerable deployments.
2. Probe the /locales/locale.json endpoint with locale and namespace query parameters.
3. Send a crafted unauthenticated request that triggers server-side code execution on vulnerable versions.
4. Run reconnaissance commands under the web server or PHP application user context.
5. Read Panel configuration and environment files to obtain application secrets and database credentials.
6. Use stolen secrets to access the database, create privileged access, or retrieve sensitive Panel and server data.
7. Access, alter, or exfiltrate files belonging to game servers managed by the Panel.
8. Deploy persistence such as a web shell, modified application file, cron job, systemd service, or unauthorized SSH key.
9. Use the compromised host for further activity such as lateral movement, malware deployment, cryptomining, or service disruption.

How to detect it

To determine whether exploitation has already occurred, review reverse proxy, web server, WAF, CDN, and application logs for requests to /locales/locale.json containing locale and namespace query parameters, especially from unauthenticated clients, unfamiliar IP addresses, scanners, or requests containing URL-encoded special characters, path traversal patterns, shell metacharacters, template-like syntax, or unusually long parameter values. Correlate suspicious requests with Laravel/PHP application errors, 500 responses, unusual response sizes, or subsequent outbound network connections from the Panel host. On the host, inspect process execution telemetry for php-fpm, php, nginx, apache2, or the web server user spawning shells or utilities such as sh, bash, curl, wget, python, perl, nc, ncat, socat, chmod, chattr, crontab, or systemctl. Review filesystem changes around the time of suspicious requests, especially new or modified PHP files under the Panel web root, files in writable storage/cache locations, new dotfiles, temporary scripts, and unauthorized SSH keys. Check Pterodactyl and Laravel logs for localization-related exceptions, unexpected namespace/locale values, authentication changes, administrator creation, API key creation, and database access anomalies. Review database logs and backups for unauthorized user creation, password resets, API token changes, and bulk reads. Network detections should look for the Panel host initiating connections to unknown external IPs shortly after suspicious endpoint access, including HTTP downloads, reverse shell-like long-lived connections, and cryptomining traffic.

• /locales/locale.json
• /locales/locale.json?locale=
• /locales/locale.json?namespace=
• GET /locales/locale.json
• POST /locales/locale.json
• locale=
• namespace=
• %2f..%2f
• ../
• ..%2f
• %3b
• %7c
• %26
• %60
• %24%28
• ${
• {{
• storage/logs/laravel.log
• /var/www/pterodactyl/.env
• /var/www/pterodactyl/storage/logs/laravel.log
• /var/www/pterodactyl/public/
• /var/www/pterodactyl/storage/
• php-fpm spawning sh
• php-fpm spawning bash
• php-fpm spawning curl
• php-fpm spawning wget
• www-data spawning sh
• www-data spawning bash
• www-data spawning curl
• www-data spawning wget
• nginx spawning sh
• apache2 spawning sh
• /tmp/.
• /dev/shm/.
• /var/spool/cron/
• /etc/cron.d/
• /etc/systemd/system/
• /root/.ssh/authorized_keys
• /home/*/.ssh/authorized_keys
• crontab -l
• curl http
• wget http
• chmod +x
• nc -e
• ncat -e
• bash -i
• sh -i

What your security team should do

• Immediately inventory all internet-facing and internally reachable Pterodactyl Panel instances and identify versions earlier than 1.11.11.
• Prioritize emergency upgrade to Pterodactyl Panel 1.11.11 or later, or verify the deployed code includes commit ac16af6d0a704c009240f18cfe3b31ca1dc24923.
• If patching cannot be completed immediately, restrict Panel access to trusted IP ranges or VPN and deploy WAF filtering for suspicious /locales/locale.json requests.
• Search historical web server, reverse proxy, WAF, CDN, and application logs for suspicious access to /locales/locale.json using locale and namespace parameters.
• Assume credential exposure if suspicious requests are found; rotate database credentials, application secrets, API keys, administrator passwords, and any tokens accessible to the Panel.
• Hunt for post-exploitation artifacts including web shells, unexpected PHP files, modified application files, new administrator accounts, unauthorized SSH keys, cron jobs, systemd services, and suspicious child processes spawned by PHP or the web server user.
• Review database audit data, Panel user changes, API key creation, and managed server file modifications for unauthorized activity.
• Increase monitoring for outbound connections from Panel hosts to unknown destinations, especially downloads via curl or wget, reverse shells, cryptomining pools, and large data transfers.
• If evidence of code execution is present, isolate affected hosts and consider rebuilding from known-good media after preserving forensic evidence.