Pterodactyl Panel: Unauthenticated Remote Code Execution (CVE-2025-49132)
CVE-2025-49132 is a critical unauthenticated remote code execution vulnerability in Pterodactyl Panel caused by local file inclusion in pearcmd.php, for which public proof-of-concept exploits are now available.
CVE search metadata
CVE search record: CVE-2025-49132. Severity: critical. CVSS: 10.0. EPSS: 54.46%. KEV: no. Product: Panel (< 1.11.11). Brief: Pterodactyl Panel: Unauthenticated Remote Code Execution (CVE-2025-49132). Brief link: https://feed.craftedsignal.io/briefs/2026-10-cve-2025-49132-pterodactyl-rce/
Triage facts
Revision 1- Applicability
- Panel (< 1.11.11)
- Evidence
- Unknown
- Severity
- Critical
- Action
- Immediate escalation
- Sources
- 3 public sources
- Freshness
- Revision 1Oct 22, 07:48 UTC
- Detection
- 1 rule
- Vulnerabilities
- 1 CVE
- Source quality
- B2Very likely
CVE-2025-49132 is a critical vulnerability (CVSS 10.0) affecting Pterodactyl Panel that allows unauthenticated attackers to perform local file inclusion (LFI) via the 'locale' and 'namespace' parameters. This vulnerability can be escalated to remote code execution (RCE) by leveraging the pearcmd.php script. A working proof-of-concept exploit script is publicly available, increasing the risk of active exploitation.
Impact
Successful exploitation allows an unauthenticated, remote attacker to execute arbitrary code on the underlying host with the privileges of the web server user. This leads to full system compromise.
Recommendation
- Upgrade Pterodactyl Panel to the version addressing GHSA-24wv-6c99-f843 immediately.
- Review web access logs for requests containing 'locale' or 'namespace' parameters combined with sequences or paths attempting to access 'pearcmd.php'.
- Monitor for unauthorized file creation or execution in the web directory and temporary directories (e.g., /tmp).
- Restrict access to the Pterodactyl Panel web interface to known trusted IP ranges.
Immediate actions
Patch Panel to 1.11.11 or later
Threat Hunt
Search logs for request patterns targeting 'pearcmd.php' with 'locale' or 'namespace' parameters.
Data: Web server access logs
Mitigations
Patch Panel to 1.11.11 or later
CVE-2025-49132
Gaps
- Automated patch management may be difficult if not centrally managed.
Detection coverage 1
Detects CVE-2025-49132 Exploitation - Web Request to pearcmd.php
criticalDetects potential exploitation attempts of CVE-2025-49132 where an attacker attempts to trigger code execution via pearcmd.php by manipulating locale parameters.
Detection queries are available on the platform. Get full rules →