CVE-2025-49132: falha crítica em pterodactyl panel
Pterodactyl Panel Allows Unauthenticated Arbitrary Remote Code Execution
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
99Vexday Risk Score
Corrija agora. Ela exploração observada pelo VulnCheck e tem exploit funcional público.
ssvc Actcvss 10epss 54%
da publicação à armano mesmo dia
Publicada no NVD20 de jun.
1ª PoC20 de jun.
metasploit19 de jun.
VulnCheck19 de jun.
Pterodactyl is a free, open-source game server management panel. Prior to version 1.11.11, using the /locales/locale.json with the locale and namespace query parameters, a malicious actor is able to execute arbitrary code without being authenticated. With the ability to execute arbitrary code it could be used to gain access to the Panel's server, read credentials from the Panel's config, extract sensitive information from the database, access files of servers managed by the panel, etc. This issue has been patched in version 1.11.11. There are no software workarounds for this vulnerability, but use of an external Web Application Firewall (WAF) could help mitigate this attack.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Produtos afetados
pterodactyl · panelPoCs públicas encontradas — 68
exploitdbwww.exploit-db.com/exploits/52341não verificadogithubgithub.com/YoyoChaud/CVE-2025-49132★ 25githubgithub.com/Zen-kun04/CVE-2025-49132★ 17githubgithub.com/malw0re/CVE-2025-49132-Mods★ 12githubgithub.com/63square/CVE-2025-49132★ 5githubgithub.com/str1keboo/CVE-2025-49132★ 5githubgithub.com/qiaojojo/CVE-2025-49132_poc★ 4githubgithub.com/rippsec/CVE-2025-49132-PHP-PEAR★ 4githubgithub.com/popyue/CVE-2025-49132★ 4githubgithub.com/0xtensho/CVE-2025-49132-poc★ 3githubgithub.com/dollarboysushil/CVE-2025-49132-Pterodactyl-Panel-Unauthenticated-Remote-Code-Execution-RCE-★ 3githubgithub.com/GRodolphe/CVE-2025-49132_poc★ 3githubgithub.com/pxxdrobits/CVE-2025-49132★ 2githubgithub.com/thealchimist86/CVE-2025-49132-Pterodactyl-Panel-RCE★ 1githubgithub.com/Pwndalf/CVE-2025-49132-PoC★ 1githubgithub.com/matesz44/CVE-2025-49132★ 1githubgithub.com/symphony2colour/HTB-Pterodactyl-RCE-CVE-2025-49132★ 1githubgithub.com/ramzihafiz/CVE-2025-49132★ 1githubgithub.com/vimmwy/CVE-2025-49132★ 1githubgithub.com/WebSafety-2tina/CVE-2025-49132★ 0githubgithub.com/typicalsmc/CVE-2025-49132-PoC★ 0githubgithub.com/kerburenthusiasm/CVE-2025-49132-PoC★ 0githubgithub.com/scroollocker/CVE-2025-49132★ 0githubgithub.com/nik123-py/CVE-2025-49132_HTB_SEASON10★ 0githubgithub.com/4nuxd/CVE-2025-49132★ 0githubgithub.com/yurahshell/CVE-2025-49132★ 0githubgithub.com/aleewyy/CVE-2025-49132★ 0githubgithub.com/V0idW1re/HTB-Pterodactyl-Writeup★ 0githubgithub.com/karimelsheikh1/HTB-Pterodactyl-Writeup★ 0githubgithub.com/2t8a/CVE-2025-49132★ 0githubgithub.com/ledksv/pterodactyl★ 0githubgithub.com/Ahmedf000/CVE-2025-49132_HTB_SEASON10★ 0githubgithub.com/melonlonmeo/CVE-2025-49132★ 0githubgithub.com/Ossipher/CVE-2025-49132_HTB_SEASON10★ 0vulncheckvulncheck.com/xdb/d14488c76804não verificadovulncheckvulncheck.com/xdb/a46e88978d3fnão verificadovulncheckvulncheck.com/xdb/c53be3f0a3ecnão verificadovulncheckvulncheck.com/xdb/86f1349d3268não verificadovulncheckvulncheck.com/xdb/1061c622231enão verificadovulncheckvulncheck.com/xdb/78762d166ba2não verificadovulncheckvulncheck.com/xdb/4524ceeb6459não verificadovulncheckvulncheck.com/xdb/23db4ac0642cnão verificadovulncheckvulncheck.com/xdb/27db0ff02fafnão verificadovulncheckvulncheck.com/xdb/7eafd91c79fdnão verificadovulncheckvulncheck.com/xdb/4487fa27f075não verificadovulncheckvulncheck.com/xdb/b5e1a9cf356anão verificadovulncheckvulncheck.com/xdb/5dffb08c1813não verificadovulncheckvulncheck.com/xdb/9cd3b1d94ac5não verificadovulncheckvulncheck.com/xdb/3092ae31c466não verificadovulncheckvulncheck.com/xdb/571b13ffff02não verificadovulncheckvulncheck.com/xdb/62fba677a15cnão verificadovulncheckvulncheck.com/xdb/1d225955a5benão verificadovulncheckvulncheck.com/xdb/567dfdc818e6não verificadovulncheckvulncheck.com/xdb/245f1085b146não verificadovulncheckvulncheck.com/xdb/c2c106ebd6e0não verificadovulncheckvulncheck.com/xdb/3d29769012ddnão verificadovulncheckvulncheck.com/xdb/1ee587c76421não verificadovulncheckvulncheck.com/xdb/a4b76021d4a3não verificadovulncheckvulncheck.com/xdb/4a43ddc95aa5não verificadovulncheckvulncheck.com/xdb/27478c3c78a9não verificadovulncheckvulncheck.com/xdb/9a716fc13bb0não verificadovulncheckvulncheck.com/xdb/87026a56384anão verificadovulncheckvulncheck.com/xdb/bc8e85534e70não verificadovulncheckvulncheck.com/xdb/257322a955ednão verificadovulncheckvulncheck.com/xdb/ecb27047a9f1não verificadovulncheckvulncheck.com/xdb/ee89cc59e31cnão verificadovulncheckvulncheck.com/xdb/20f9996dd19bnão verificadovulncheckvulncheck.com/xdb/9ee1016338d0não verificado⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — pterodactyl panel
No mesmo produto, das mais perigosas para as menos.
CVE-2021-41129HIGHAuthentication bypass in PterodactylEPSS 1.8%CVE-2026-54593HIGHPterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissionsEPSS 0.7%CVE-2026-86177HIGHPterodactyl Panel before 1.14.1 Privilege Escalation via Schedule TasksEPSS 0.6%CVE-2021-41176MEDIUMlogout CSRF in Pterodactyl PanelEPSS 0.5%CVE-2026-61609HIGHPterodactyl's shared global rate-limit key on login and 2FA checkpoint enables unauthenticated panel-wide authentication lockout (DoS)EPSS 0.5%CVE-2024-34067MEDIUMMultiple cross site scripting (XSS) vulnerabilities in the admin area of Pterodactyl panelEPSS 0.5%