{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/panel--1.11.11/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:pterodactyl:panel:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":10,"id":"CVE-2025-49132"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Panel (\u003c 1.11.11)"],"_cs_severities":["critical"],"_cs_tags":["remote-code-execution","lfi","pterodactyl","cve-2025-49132"],"_cs_type":"advisory","_cs_vendors":["Pterodactyl"],"content_html":"\u003cp\u003eCVE-2025-49132 is a critical vulnerability (CVSS 10.0) affecting Pterodactyl Panel that allows unauthenticated attackers to perform local file inclusion (LFI) via the 'locale' and 'namespace' parameters. This vulnerability can be escalated to remote code execution (RCE) by leveraging the pearcmd.php script. A working proof-of-concept exploit script is publicly available, increasing the risk of active exploitation.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an unauthenticated, remote attacker to execute arbitrary code on the underlying host with the privileges of the web server user. This leads to full system compromise.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Pterodactyl Panel to the version addressing GHSA-24wv-6c99-f843 immediately.\u003c/li\u003e\n\u003cli\u003eReview web access logs for requests containing 'locale' or 'namespace' parameters combined with sequences or paths attempting to access 'pearcmd.php'.\u003c/li\u003e\n\u003cli\u003eMonitor for unauthorized file creation or execution in the web directory and temporary directories (e.g., /tmp).\u003c/li\u003e\n\u003cli\u003eRestrict access to the Pterodactyl Panel web interface to known trusted IP ranges.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-22T07:48:52Z","date_published":"2026-10-22T07:48:52Z","id":"https://feed.craftedsignal.io/briefs/2026-10-cve-2025-49132-pterodactyl-rce/","summary":"CVE-2025-49132 is a critical unauthenticated remote code execution vulnerability in Pterodactyl Panel caused by local file inclusion in pearcmd.php, for which public proof-of-concept exploits are now available.","title":"Pterodactyl Panel: Unauthenticated Remote Code Execution (CVE-2025-49132)","url":"https://feed.craftedsignal.io/briefs/2026-10-cve-2025-49132-pterodactyl-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Panel (\u003c 1.11.11)","version":"https://jsonfeed.org/version/1.1"}