Pterodactyl Panel CVE-2025-49132 Remote Code Execution

MetasploitMetasploit exploitExploitRubyexploit_linux/http/pterodactyl_locales_locale_json

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

Metasploit
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Metasploit module that exploits CVE-2025-49132 in Pterodactyl Panel < 1.11.11 to achieve unauthenticated remote code execution via path traversal and PEAR command injection through the /locales/locale.json endpoint.

Backdoor review

No backdoor observed in reviewed code

The reviewed Metasploit module source code implements a standard remote code execution exploit for CVE-2025-49132 in Pterodactyl Panel. It uses path traversal and PEAR command injection to upload and execute a user-supplied payload. No backdoor, deceptive payload, or concealed operator-directed harm was observed. The module's behavior is consistent with its documented purpose.

ClassificationExploit
Model confidence100%
AuthenticationNot required
Languagesruby
Target softwarePterodactyl Panel
Attack typescode injectionpath traversal
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The module is a complete Metasploit exploit that includes check, upload, and execute methods to achieve remote code execution on a vulnerable target. It generates and delivers a payload, not merely detecting the vulnerability.

modules/exploits/linux/http/pterodactyl_locales_locale_json.rb:8modules/exploits/linux/http/pterodactyl_locales_locale_json.rb:107-113modules/exploits/linux/http/pterodactyl_locales_locale_json.rb:115-135modules/exploits/linux/http/pterodactyl_locales_locale_json.rb:137-149

Requirements

  • Target must be running Pterodactyl Panel version < 1.11.11modules/exploits/linux/http/pterodactyl_locales_locale_json.rb:21
  • Target must have the /locales/locale.json endpoint accessiblemodules/exploits/linux/http/pterodactyl_locales_locale_json.rb:75

Observed behavior

  • Sends a GET request to /locales/locale.json with path traversal in the locale parameter to create a PHP payload file in /tmp via PEAR config-create command injectionmodules/exploits/linux/http/pterodactyl_locales_locale_json.rb:155-159
  • Sends a second GET request to /locales/locale.json to execute the uploaded PHP payload by including it via namespace parametermodules/exploits/linux/http/pterodactyl_locales_locale_json.rb:162-166
  • Payload is a PHP one-liner that executes a Metasploit-generated command payload using system()modules/exploits/linux/http/pterodactyl_locales_locale_json.rb:151-153
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Mechanism
Path traversal via locale.json endpoint to create a PHP file in /tmp, then execute it via PEAR command injectionThe module exploits the vulnerability as described in the CVE and module metadata. It does not perform any unrelated actions.modules/exploits/linux/http/pterodactyl_locales_locale_json.rb:20-27modules/exploits/linux/http/pterodactyl_locales_locale_json.rb:107-113modules/exploits/linux/http/pterodactyl_locales_locale_json.rb:155-160modules/exploits/linux/http/pterodactyl_locales_locale_json.rb:162-167
Payload Generation
<?=system('#{payload.encoded}')?>The module generates a PHP one-liner that executes the Metasploit payload. This is a standard technique for command execution exploits.modules/exploits/linux/http/pterodactyl_locales_locale_json.rb:151-153
Cleanup Registration
register_file_for_cleanup(payload_file)The module registers the uploaded payload file for cleanup, which is a standard Metasploit practice and not indicative of backdoor behavior.modules/exploits/linux/http/pterodactyl_locales_locale_json.rb:133
Review boundaries

What the analysis did not establish

  • Analysis is based on module source code only; framework mixins, libraries, and external payloads are not expanded.
  • No runtime behavior or target interaction was observed; classification relies on static code analysis of the provided Ruby source.
  • Only the module source code and metadata were reviewed. The Metasploit framework mixins (e.g., Msf::Exploit::Remote::HttpClient, Msf::Exploit::FileDropper) and the external payload generation logic were not expanded or inspected.
  • Binary files were not present in the evidence.
  • The review does not assess the safety or reliability of the exploit against the target application.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1