Skip to main content
CRITICAL

CVE-2025-49132

CVSS v3

10

CRITICAL

EPSS Score

54.5 %

exploit probability, as of 2026-10-05

CISA KEV

No

known exploited

Exploitation

—

SSVC status

Description

Pterodactyl is a free, open-source game server management panel. Prior to version 1.11.11, using the /locales/locale.json with the locale and namespace query parameters, a malicious actor is able to execute arbitrary code without being authenticated. With the ability to execute arbitrary code it could be used to gain access to the Panel's server, read credentials from the Panel's config, extract sensitive information from the database, access files of servers managed by the panel, etc. This issu

Technical details

Published
2025-06-20
Last Modified
2026-04-15
Exploit-DB
EDB-52341

Frequently asked questions

What is CVE-2025-49132?

Pterodactyl is a free, open-source game server management panel. Prior to version 1.11.11, using the /locales/locale.json with the locale and namespace query parameters, a malicious actor is able to execute arbitrary code without being authenticated. With the ability to execute arbitrary code it could be used to gain access to the Panel's server, read credentials from the Panel's config, extract sensitive information from the database, access files of servers managed by the panel, etc. This issu

Is CVE-2025-49132 actively exploited?

Active exploitation of CVE-2025-49132 has not been confirmed. Its EPSS score was 54.5% on 2026-10-05, the estimated probability of exploitation in the next 30 days.

What is the CVSS score for CVE-2025-49132?

CVE-2025-49132 has a CVSS v3 base score of 10 (CRITICAL severity).

Is CVE-2025-49132 affecting your environment?

Use isMalicious to check if any of your IPs or domains are associated with this vulnerability's IOCs.

Check an IPSearch CVEsSIEM & TIP integrations

No credit card required · 50 free checks/month · Free API key

Other 2025 vulnerabilities worth triaging

Ranked by exploit probability (EPSS).

Back to CVE Database