CVE-2025-49132

Pterodactyl is a free, open-source game server management panel. Prior to version 1.11.11, using the /locales/locale.json with the locale and namespace query parameters, a malicious actor is able to execute arbitrary code without being authenticated. With the ability to execute arbitrary code it could be used to gain access to the Panel's server, read credentials from the Panel's config, extract sensitive information from the database, access files of servers managed by the panel, etc. This issue has been patched in version 1.11.11. There are no software workarounds for this vulnerability, but use of an external Web Application Firewall (WAF) could help mitigate this attack.

• CWE-94

• https://github.com/pterodactyl/panel/commit/24c82b0e335fb5d7a844226b08abf9f176e592f0
• https://github.com/pterodactyl/panel/releases/tag/v1.11.11
• https://github.com/pterodactyl/panel/security/advisories/GHSA-24wv-6c99-f843

Published

Jun 20, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-49126Visionatrix is an AI Media processing tool using ComfyUI. In…8.8
• CVE-2025-49127Kafbat UI is a web user interface for managing Apache Kafka …8.9
• CVE-2025-49128Jackson-core contains core low-level incremental ("streaming…4
• CVE-2025-4913A vulnerability was found in PHPGurukul Auto Taxi Stand Mana…9.8
• CVE-2025-49130Laravel Translation Manager is a package to manage Laravel t…6
• CVE-2025-49131FastGPT is an open-source project that provides a platform f…9.9
• CVE-2025-49133Libtpms is a library that targets the integration of TPM fun…5.5
• CVE-2025-49134Weblate is a web based localization tool. Prior to version 5…5.3
• CVE-2025-49135CVAT is an open source interactive video and image annotatio…6.5
• CVE-2025-49136listmonk is a standalone, self-hosted, newsletter and mailin…6.5
• CVE-2025-49137HAX CMS PHP allows users to manage their microsite universe …6.1
• CVE-2025-49138HAX CMS PHP allows users to manage their microsite universe …6.5