EUVD-2025-18765
GHSA-24wv-6c99-f843
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
5Tags
Description
Pterodactyl is a free, open-source game server management panel. Prior to version 1.11.11, using the /locales/locale.json with the locale and namespace query parameters, a malicious actor is able to execute arbitrary code without being authenticated. With the ability to execute arbitrary code it could be used to gain access to the Panel's server, read credentials from the Panel's config, extract sensitive information from the database, access files of servers managed by the panel, etc. This issue has been patched in version 1.11.11. There are no software workarounds for this vulnerability, but use of an external Web Application Firewall (WAF) could help mitigate this attack.
Analysis
Pterodactyl game server management panel prior to version 1.11.11 contains an unauthenticated remote code execution via the /locales/locale.json endpoint. By manipulating the locale and namespace query parameters, attackers can execute arbitrary code on the panel server, gaining control over all managed game servers.
Technical Context
The /locales/locale.json endpoint processes locale and namespace parameters without proper sanitization, allowing code injection that executes on the Pterodactyl panel server. The panel manages Docker-based game server instances and stores database credentials, API keys, and server configurations.
Affected Products
['Pterodactyl Panel < 1.11.11']
Remediation
Update to Pterodactyl 1.11.11 or later immediately. Restrict panel access via firewall rules. Rotate database credentials and API keys. Audit managed servers for unauthorized modifications.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today