Cve-2025-49132 - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/cve-2025-49132/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 22 Oct 2026 07:48:52 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgPterodactyl Panel: Unauthenticated Remote Code Execution (CVE-2025-49132)https://feed.craftedsignal.io/briefs/2026-10-cve-2025-49132-pterodactyl-rce/Thu, 22 Oct 2026 07:48:52 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-cve-2025-49132-pterodactyl-rce/CVE-2025-49132 is a critical unauthenticated remote code execution vulnerability in Pterodactyl Panel caused by local file inclusion in pearcmd.php, for which public proof-of-concept exploits are now available.CVE-2025-49132 is a critical vulnerability (CVSS 10.0) affecting Pterodactyl Panel that allows unauthenticated attackers to perform local file inclusion (LFI) via the 'locale' and 'namespace' parameters. This vulnerability can be escalated to remote code execution (RCE) by leveraging the pearcmd.php script. A working proof-of-concept exploit script is publicly available, increasing the risk of active exploitation.

Impact

Successful exploitation allows an unauthenticated, remote attacker to execute arbitrary code on the underlying host with the privileges of the web server user. This leads to full system compromise.

Recommendation

  • Upgrade Pterodactyl Panel to the version addressing GHSA-24wv-6c99-f843 immediately.
  • Review web access logs for requests containing 'locale' or 'namespace' parameters combined with sequences or paths attempting to access 'pearcmd.php'.
  • Monitor for unauthorized file creation or execution in the web directory and temporary directories (e.g., /tmp).
  • Restrict access to the Pterodactyl Panel web interface to known trusted IP ranges.
]]>criticaladvisoryremote-code-executionlfipterodactylcve-2025-49132