CVE-2025-49132

Pterodactyl Panel, a widely used free and open-source game server management panel, contains an unauthenticated arbitrary code execution flaw (CWE-94 code injection) in versions prior to 1.11.11. An attacker triggers it by sending a crafted request to the /locales/locale.json endpoint with malicious locale and namespace query parameters, requiring no credentials or user interaction. Successful exploitation yields code execution on the Panel's server, allowing the attacker to read credentials from the Panel's configuration, extract sensitive data from its database, and access files of the game servers the panel manages. Any deployment running Pterodactyl Panel older than 1.11.11 is affected, and the panel's web-facing nature makes internet-exposed instances the primary targets. No public proof-of-concept or confirmed in-the-wild exploitation is known yet, and the flaw is not on CISA's KEV list, but a high EPSS score (53.4% probability of exploitation within 30 days, 99th percentile) indicates a strong likelihood of near-term exploitation.

What to do: Upgrade Pterodactyl Panel to version 1.11.11 immediately, as no software workarounds exist; until patched, restrict internet exposure of the panel and place a WAF in front of it to filter malicious requests. Review panel logs for suspicious requests to /locales/locale.json with unusual locale or namespace parameters, and rotate panel configuration and database credentials since the config contains secrets an attacker may have read.