Pterodactyl Panel Unauthenticated Path Traversal via locale.json Leaking Database Credentials (CVE-2025-49132)

Metadata

Affected Target

Summary

Pterodactyl Panel prior to version 1.11.11 exposes a /locales/locale.json endpoint that accepts attacker-controlled locale and namespace query parameters without a required integrity/hash check, allowing an unauthenticated attacker to traverse outside the intended locale-file directory and force the panel to load and reflect the contents of arbitrary PHP configuration files as JSON. By pointing locale at a relative path traversal sequence (e.g. ../../../pterodactyl) and namespace at config/database, the attacker causes the panel’s PHP config array for config/database.php to be returned in the JSON response, leaking the live MySQL host, port, database name, username, and password. The included PoC sends this request and parses the leaked credentials directly out of the JSON response. With direct database access (or access to phpMyAdmin), an attacker can insert a row into the users table to create an administrator account and gain full control of the panel and every game server it manages.

Vulnerability Details

Root Cause

The /locales/locale.json endpoint builds a file path from the client-supplied locale and namespace parameters without sanitizing directory traversal sequences, and without enforcing the hash= parameter that is meant to gate which locale files can be requested. Because Pterodactyl’s PHP config files (e.g. config/database.php) return arrays when included, requesting them through the locale-loading mechanism causes their in-memory array contents (including database credentials) to be serialized into the JSON response instead of being treated as an error.

Attack Vector

1. Send GET /locales/locale.json to the target and confirm it returns a JSON body without a hash= parameter present — this indicates the traversal check is not enforced (i.e., the instance is vulnerable).
2. Send GET /locales/locale.json?locale=../../../pterodactyl&namespace=config/database — the traversal in locale escapes the intended locale directory and resolves to the application root, and namespace=config/database selects config/database.php for inclusion.
3. The server responds with JSON containing the parsed contents of the PHP config array, including connections.mysql.host, port, database, username, and password.
4. The attacker uses the leaked database credentials to connect directly (if port 3306 or a local/hosted phpMyAdmin is reachable) and inserts a new row into the users table to create an administrator-level Pterodactyl account.
5. The attacker logs into the panel with the newly created administrator account, gaining full control of the panel and all managed game servers (which can be used to obtain a reverse shell on the host).

Impact

Complete unauthenticated compromise of the Pterodactyl Panel: disclosure of database credentials, arbitrary code execution potential via crafted config files, database tampering to create administrator accounts, and full takeover of the panel and all managed game servers.

Environment / Lab Setup

Target:   Pterodactyl Panel < 1.11.11, network-reachable /locales/locale.json endpoint
Attacker: Python 3 with `requests` and `colorama` installed

Proof of Concept

PoC Script

See CVE-2025-49132_PoC.py in this folder.

1

python3 CVE-2025-49132_PoC.py http://TARGET

Sends GET /locales/locale.json?locale=../../../pterodactyl&namespace=config/database to the target and, if vulnerable, parses and prints the leaked MySQL username:password@host:port/database connection string directly from the JSON response.

Detection & Indicators of Compromise

Signs of compromise:

• Access log entries for /locales/locale.json?locale=../ traversal requests
• Unexpected new administrator accounts appearing in the panel’s users table
• Unrecognized direct database connections to the Pterodactyl MySQL instance
• Unexplained server/game-instance creation or reverse shell activity originating from panel-managed servers

Remediation

References

• Source repository

Notes

Mirrored from https://github.com/vimmwy/CVE-2025-49132 on 2026-07-06. CVE-2025-49132_PoC.py sends the real locale.json path-traversal request and parses leaked Pterodactyl DB credentials.