Detections
Analytics
SCA: security update for pterodactyl/panel (GHSA-24wv-6c99-f843)
critical Tenable Cloud Security Plugin ID 436942
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- Pterodactyl is a free, open-source game server management panel. Prior to version 1.11.11, using the
/locales/locale.json with the locale and namespace query parameters, a malicious actor is able to execute
arbitrary code without being authenticated. With the ability to execute arbitrary code it could be used to
gain access to the Panel's server, read credentials from the Panel's config, extract sensitive information
from the database, access files of servers managed by the panel, etc. This issue has been patched in
version 1.11.11. There are no software workarounds for this vulnerability, but use of an external Web
Application Firewall (WAF) could help mitigate this attack. (CVE-2025-49132)
See Also
Plugin Details
Severity: Critical
ID: 436942
Version: Revision 1.3
Type: Local
Family: SCA Checks
Published: 1/26/2026
Updated: 6/1/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: High
Score: 7
Percentile: 98.33
Vendor
Vendor Severity: Critical
CVSS v2
Risk Factor: Critical
Base Score: 10
Temporal Score: 7.8
Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C
CVSS Score Source: CVE-2025-49132
CVSS v3
Risk Factor: Critical
Base Score: 10
Temporal Score: 9
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
Vulnerability Information
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 6/19/2025
Vulnerability Publication Date: 6/19/2025
Reference Information
CVE: CVE-2025-49132
cwe: CWE-94