CVE-2025-49132: Pterodactyl Panel RCE Vulnerability

CVE-2025-49132 Overview

CVE-2025-49132 is a critical Remote Code Execution (RCE) vulnerability affecting Pterodactyl Panel, a free, open-source game server management panel. The vulnerability exists in the /locales/locale.json endpoint where the locale and namespace query parameters lack proper input validation, allowing unauthenticated attackers to execute arbitrary code on the server.

This vulnerability is classified under CWE-94 (Improper Control of Generation of Code / Code Injection), representing a severe security flaw that enables complete system compromise without requiring any authentication.

Critical Impact

Unauthenticated attackers can achieve full remote code execution, potentially compromising the Panel server, extracting database credentials, accessing sensitive configuration files, and gaining control over all game servers managed by the affected Pterodactyl installation.

Affected Products

• Pterodactyl Panel versions prior to 1.11.11

Discovery Timeline

• 2025-06-20 - CVE-2025-49132 published to NVD
• 2025-06-23 - Last updated in NVD database

Technical Details for CVE-2025-49132

Vulnerability Analysis

The vulnerability resides in the LocaleController.php file within the Pterodactyl Panel application. The /locales/locale.json endpoint accepts user-controlled locale and namespace query parameters that were processed without adequate input validation or sanitization. This lack of validation allows attackers to inject malicious payloads that are interpreted as code by the application.

The attack surface is particularly dangerous because the endpoint does not require authentication, meaning any network-accessible attacker can exploit this vulnerability. Successful exploitation grants the attacker the same privileges as the web application process, typically allowing file system access, database queries, and interaction with managed game servers.

Root Cause

The root cause is insufficient input validation on the locale and namespace parameters in the LocaleController. Prior to the patch, the application used a generic Illuminate\Http\Request object without enforcing strict validation rules on these parameters. This allowed specially crafted input values to bypass intended restrictions and trigger code injection.

Attack Vector

The attack is conducted over the network by sending crafted HTTP requests to the /locales/locale.json endpoint. The attacker manipulates the locale and namespace query parameters with malicious payloads designed to achieve code execution. Since no authentication is required, the attack can be launched by any entity with network access to the Pterodactyl Panel.

The security patch introduces a dedicated LocaleRequest class with strict regex validation rules:

// Security patch introducing input validation
// Source: https://github.com/pterodactyl/panel/commit/24c82b0e335fb5d7a844226b08abf9f176e592f0

namespace Pterodactyl\Http\Requests\Base;

use Illuminate\Foundation\Http\FormRequest;

class LocaleRequest extends FormRequest
{
    public function rules(): array
    {
        return [
            'locale' => ['required', 'string', 'regex:/^[a-z][a-z]$/'],
            'namespace' => ['required', 'string', 'regex:/^[a-z]{1,191}$/'],
        ];
    }
}

The patch restricts the locale parameter to exactly two lowercase letters and the namespace parameter to lowercase letters only (1-191 characters), effectively preventing code injection payloads.

Detection Methods for CVE-2025-49132

Indicators of Compromise

• Unusual or malformed requests to /locales/locale.json containing special characters, escape sequences, or unexpected payloads in the locale or namespace parameters
• Unexpected process spawning or command execution originating from the web server process
• Unauthorized file access or modifications in the Pterodactyl Panel directory structure
• Database queries or credential extraction attempts from the Panel's configuration files

Detection Strategies

• Monitor web server access logs for requests to /locales/locale.json with abnormal parameter values that deviate from standard two-letter locale codes
• Implement Web Application Firewall (WAF) rules to detect and block requests containing code injection patterns in query parameters
• Deploy endpoint detection and response (EDR) solutions to identify unauthorized code execution from web application processes
• Review application logs for translation loading errors or exceptions that may indicate exploitation attempts

Monitoring Recommendations

• Enable verbose logging on the Pterodactyl Panel application to capture detailed request information
• Configure alerting for any requests to the locale endpoint containing non-alphabetic characters
• Monitor system process trees for child processes spawned by PHP or the web server that indicate command execution
• Implement network segmentation monitoring to detect lateral movement if the Panel server is compromised

How to Mitigate CVE-2025-49132

Immediate Actions Required

• Upgrade Pterodactyl Panel to version 1.11.11 or later immediately
• If immediate patching is not possible, deploy a Web Application Firewall (WAF) to filter malicious requests to the /locales/locale.json endpoint
• Restrict network access to the Pterodactyl Panel to trusted IP addresses only
• Review server logs for signs of prior exploitation and conduct incident response if compromise indicators are found

Patch Information

The vulnerability has been patched in Pterodactyl Panel version 1.11.11. The fix introduces strict input validation through a new LocaleRequest class that enforces regex patterns on the locale and namespace parameters, preventing injection attacks.

For detailed patch information, refer to:

• GitHub Security Advisory GHSA-24wv-6c99-f843
• GitHub Release v1.11.11
• Security Commit

Workarounds

• Deploy an external Web Application Firewall (WAF) with rules to block requests containing non-alphabetic characters in the locale and namespace parameters
• Implement network-level access controls to restrict access to the Pterodactyl Panel administrative interface
• Use reverse proxy configurations to filter and sanitize incoming requests to the vulnerable endpoint

# Example nginx WAF configuration to filter malicious locale requests
location /locales/locale.json {
    # Only allow requests with valid locale format (two lowercase letters)
    if ($arg_locale !~ "^[a-z]{2}$") {
        return 403;
    }
    # Only allow requests with valid namespace format (lowercase letters only)
    if ($arg_namespace !~ "^[a-z]+$") {
        return 403;
    }
    proxy_pass http://pterodactyl_backend;
}