pterodactyl panel up to 1.11.10 /locales/locale.json locale/namespace code injection

Summaryinfo

A vulnerability, which was classified as critical, has been found in pterodactyl panel up to 1.11.10. Affected by this issue is some unknown functionality of the file /locales/locale.json. Performing a manipulation of the argument locale/namespace results in code injection. This vulnerability is known as CVE-2025-49132. Remote exploitation of the attack is possible. Furthermore, an exploit is available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, was found in pterodactyl panel up to 1.11.10. This affects an unknown functionality of the file /locales/locale.json. The manipulation of the argument locale/namespace with an unknown input leads to a code injection vulnerability. CWE is classifying the issue as CWE-94. The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Pterodactyl is a free, open-source game server management panel. Prior to version 1.11.11, using the /locales/locale.json with the locale and namespace query parameters, a malicious actor is able to execute arbitrary code without being authenticated. With the ability to execute arbitrary code it could be used to gain access to the Panel's server, read credentials from the Panel's config, extract sensitive information from the database, access files of servers managed by the panel, etc. This issue has been patched in version 1.11.11. There are no software workarounds for this vulnerability, but use of an external Web Application Firewall (WAF) could help mitigate this attack.

The weakness was published by Firewall as GHSA-24wv-6c99-f843. The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2025-49132 since 06/02/2025. The exploitability is told to be easy. It is possible to initiate the attack remotely. Technical details and a public exploit are known. MITRE ATT&CK project uses the attack technique T1059 for this issue.

The exploit is shared for download at exploit-db.com. It is declared as proof-of-concept. By approaching the search of inurl:locales/locale.json it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 1.11.11 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 24c82b0e335fb5d7a844226b08abf9f176e592f0 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at Exploit-DB (52341). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• pterodactyl

Name

• panel

Version

• 1.11.0
• 1.11.1
• 1.11.2
• 1.11.3
• 1.11.4
• 1.11.5
• 1.11.6
• 1.11.7
• 1.11.8
• 1.11.9
• 1.11.10

License

• open-source

Website

• Product: https://github.com/pterodactyl/panel/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion