CVE-2025-49132: 
PHP vulnerability analysis and mitigation

CVE-2025-49132 is a critical unauthenticated remote code execution (RCE) vulnerability in Pterodactyl Panel, a free open-source game server management panel. The flaw exists in all versions prior to 1.11.11 and allows any unauthenticated attacker to execute arbitrary code on the panel server by abusing the /locales/locale.json endpoint with crafted locale and namespace query parameters. The advisory was published on June 19, 2025, and the patch was released the same day under version 1.11.11. It carries a CVSS v3.1 base score of 10.0 (Critical) (GitHub Advisory, Pterodactyl Advisory).

The root cause is improper input validation (CWE-94 / CWE-20) in the LocaleController PHP class, which previously accepted arbitrary user-supplied values for the locale and namespace query parameters without sanitization. The vulnerable code passed these parameters directly to $this->loader->load($locale, str_replace('.', '/', $namespace)), enabling path traversal or code injection through the translation loader mechanism. The fix introduced a new LocaleRequest form request class that enforces strict regex validation — locale must match /^[a-z][a-z]$/ and namespace must match /^[a-z]{1,191}$/ — preventing malicious input from reaching the loader. No authentication is required to reach the vulnerable endpoint, making this trivially exploitable over the network (Pterodactyl Advisory, Patch Commit).

Successful exploitation grants an unauthenticated attacker arbitrary code execution on the Pterodactyl Panel server, resulting in full confidentiality, integrity, and availability compromise. An attacker can read credentials from the panel's .env configuration file, extract sensitive database contents (usernames, emails, hashed passwords, IP addresses), and access files belonging to game servers managed by the panel. The changed scope in the CVSS score reflects that exploitation can impact resources beyond the panel itself, including all game servers under its management (GitHub Advisory).

Multiple proof-of-concept exploits are publicly available on GitHub, with at least 12 distinct PoC repositories identified, and the vulnerability has also been published on Exploit-DB (EDB-ID:52341) and Sploitus (GitHub Advisory, Feedly). A Metasploit module pull request has been submitted, and Nuclei detection templates have been added to the ProjectDiscovery template library. The EPSS score is approximately 12.5–23.7% (94th percentile), indicating a high probability of exploitation. The Pterodactyl maintainer noted that shortly after the patch release, security researchers and malicious actors began actively attempting exploitation, though no confirmed successful breaches in the wild had been officially reported at time of disclosure. The vulnerability is not currently listed in the CISA KEV catalog (Pterodactyl Advisory).

1. Reconnaissance: Identify internet-facing Pterodactyl Panel instances (versions ≤ 1.11.10) using Shodan, Censys, or similar tools by searching for Pterodactyl Panel fingerprints. The panel is commonly hosted on port 80/443.
2. Confirm vulnerability: Send a benign GET request to /locales/locale.json?locale=en&namespace=test and observe the response to confirm the endpoint is accessible and the panel version is unpatched.
3. Craft malicious payload: Construct a GET or POST request to /locales/locale.json with the locale and/or namespace parameters containing a path traversal or code injection payload that exploits the unsanitized input passed to the Laravel translation loader (e.g., using directory traversal sequences or PHP file inclusion via the namespace parameter to load attacker-controlled content).
4. Achieve code execution: The malicious input causes the translation loader to process attacker-controlled content as PHP code, resulting in arbitrary command execution on the server as the web server process user.
5. Post-exploitation: Read the .env file for database credentials and application secrets, dump the database for user data, establish persistence via a web shell, or pivot to game servers managed by the panel (Pterodactyl Advisory, Patch Commit).

• Network: Unusual or repeated GET/POST requests to /locales/locale.json with non-standard locale or namespace parameter values (e.g., containing /, .., %2F, or values not matching simple two-letter locale codes); outbound connections from the panel server to unknown external IPs.
• Logs: Web server access logs showing requests to /locales/locale.json with anomalous query parameters; PHP error logs indicating unexpected file load attempts or code evaluation errors from the LocaleController.
• File System: Newly created PHP files or web shells in the Pterodactyl Panel web root or storage directories; unexpected modifications to .env or configuration files; new cron jobs or scheduled tasks created by the web server user.
• Process: Unusual child processes spawned by the PHP-FPM or web server process (e.g., bash, curl, wget, python, nc); unexpected outbound network connections initiated by the web server process (Pterodactyl Advisory, DIVD Case).

The only complete fix is upgrading Pterodactyl Panel to version 1.11.11 or later. For installations that cannot be immediately upgraded, the patch can be applied manually using the patch file from commit 24c82b0 via git apply. Disabling the /locales/locale.json endpoint at the web server level is possible but will break localization functionality. As a partial mitigation, deploying an external Web Application Firewall (WAF) — such as Cloudflare's WAF with the default ruleset (Pro plan or above required) — can help block exploitation attempts. There are no software-level workarounds that fully mitigate the vulnerability without patching (Pterodactyl Advisory, v1.11.11 Release).

The Pterodactyl maintainer (matthewpi) published an urgent user notice alongside the advisory, warning that malicious actors began attempting exploitation almost immediately after the patch was released and urging all users to update without delay (Pterodactyl Advisory). The self-hosted community on Reddit posted a security PSA alerting Pterodactyl users to the critical flaw. DIVD (Dutch Institute for Vulnerability Disclosure) opened case DIVD-2025-00032 to track and notify affected parties (DIVD Case). Security researchers on Mastodon (infosec.exchange) and Bluesky also flagged the vulnerability, and it was covered in multiple vulnerability digest newsletters including Secret CISO and Cyble's weekly reports.