CVE-2025-68954

Name: CVE-2025-68954
Creator: NVD / NIST
Published: 2026-01-06T01:16:01.387+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

HIGHCVSS 7.5/10EPSS 0.22%

Last modified Jun 17, 2026

CVE-2025-68954 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. Pterodactyl is a free, open-source game server management panel. Versions 1.11.11 and below do not revoke active SFTP connections when a user is removed from a server instance or has their permissions changes with respect to file access over SFTP. EPSS estimates a 0.22% chance of exploitation in the next 30 days.

Description

Pterodactyl is a free, open-source game server management panel. Versions 1.11.11 and below do not revoke active SFTP connections when a user is removed from a server instance or has their permissions changes with respect to file access over SFTP. This allows a user that was already connected to SFTP to remain connected and access files even after their permissions are revoked. A user must have been connected to SFTP at the time of their permissions being revoked in order for this vulnerability to be exploited. This issue is fixed in version 1.12.0.

Metrics

CVSS 3.1

5.4/10

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

CVSS 4.0

7.5/10

CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Probability

0.22%

12.2th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-613

Affected Software

Vendor	Product	Versions
Pterodactyl	Panel	< 1.12.0
Pterodactyl	Wings	< 1.12.0

References

https://github.com/pterodactyl/panel/commit/2bd9d8baddb0e0606e4a9d5be402f48678ac88d5Patch
https://github.com/pterodactyl/panel/releases/tag/v1.12.0Product, Release Notes
https://github.com/pterodactyl/panel/security/advisories/GHSA-8c39-xppg-479cVendor Advisory

Timeline

Published: Jan 6, 2026
Last Modified: Jun 17, 2026
Status: Analyzed

Frequently Asked Questions

What is CVE-2025-68954?

How severe is CVE-2025-68954?

CVE-2025-68954 has a CVSS score of 7.5/10 (HIGH severity). The EPSS model estimates a 0.22% probability of exploitation in the next 30 days.

How do I fix CVE-2025-68954?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2025-68954?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST