CVE-2025-49132 - 10.0 (Critical)

https://github.com/pterodactyl/panel/security/advisories/GHSA-24wv-6c99-f843

Vulnerable versions: 1.9.0 .. 1.11.10

OpSec Considerations

RCE exploitation is limited but can be detected through:

cat /var/www/pterodactyl/storage/logs/laravel-2025-*-*.log | grep 'Illuminate\\\\Translation\\\\FileLoader->load()'

If access logs are disabled as they are with default configuration (without SSL) credential dumping cannot be detected as easily, otherwise you can search for locale=.. in the access logs

Legal

This is entirely for educational purposes or for use in authorized challenges such as a CTF, it is illegal to attack a machine without prior permission.