CVE-2025-68954

HIGH EPSS 12.2%
Published Jan 6, 20265mo ago · Modified Jun 17, 20262w ago
7.5 CVSS 4.0
High
Find Similar
Published Jan 6, 2026 5mo ago
Last Modified Jun 17, 2026 2w ago

Description

Pterodactyl is a free, open-source game server management panel. Versions 1.11.11 and below do not revoke active SFTP connections when a user is removed from a server instance or has their permissions changes with respect to file access over SFTP. This allows a user that was already connected to SFTP to remain connected and access files even after their permissions are revoked. A user must have been connected to SFTP at the time of their permissions being revoked in order for this vulnerability to be exploited. This issue is fixed in version 1.12.0.

CVSS Details

Base Score
7.5
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity Low
Privileges Required High
User Interaction None
Scope X

Threat Intelligence

EPSS Exploit Probability
12.2% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-613

Affected Products 2

VendorProductVersionRange
pterodactylpanel* <1.12.0
pterodactylwings* <1.12.0

References 3

  • github.com https://github.com/pterodactyl/panel/commit/2bd9d8baddb0e0606e4a9d5be402f48678ac88d5
    Patch
  • github.com https://github.com/pterodactyl/panel/releases/tag/v1.12.0
    ProductRelease Notes
  • github.com https://github.com/pterodactyl/panel/security/advisories/GHSA-8c39-xppg-479c
    Vendor Advisory

Remediation

  • github.com https://github.com/pterodactyl/panel/commit/2bd9d8baddb0e0606e4a9d5be402f48678ac88d5
    Patch