CVE-2025-69198: Pterodactyl/panel Remote Code Execution Vulnerability

MODERATE
Advisory Identifier: GHSA-jw2v-cq5x-q68g
Share
CVSS 6.5
CWE-413 CWE-362 CWE-400 CWE-667
Published
Advisory Summary

CVE-2025-69198 is a MODERATE (CVSS 6.5) remote code execution vulnerability (CWE-413: Improper Resource Locking) affecting Pterodactyl/panel libraries in the Packagist ecosystem. The issue involves pterodactyl improperly locks resources allowing raced queries to create more resources than alloted. Remediation is available by upgrading affected packages to version 1.12.0.

CVE-2025-69198 at a Glance

CVE Identifier CVE-2025-69198
GHSA Identifier GHSA-jw2v-cq5x-q68g
Severity MODERATE
CVSS v3.1 Base Score 6.5
CWE Classification CWE-413: Improper Resource Locking
Affected Product Pterodactyl/panel
Package Ecosystem Packagist
Published Date
Last Updated

Security Impact

CVSS: 6.5

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

Attack Vector Network (AV:N)
Attack Complexity Low (AC:L)
Privileges Required Low (PR:L)
User Interaction None (UI:N)
Scope Unchanged (S:U)
Confidentiality None (C:N)
Integrity None (I:N)
Availability High (A:H)

How to Fix CVE-2025-69198

To remediate this vulnerability, upgrade all affected Pterodactyl/panel dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

pterodactyl/panel fixed: 1.12.0 
Upgrade pterodactyl/panel to 1.12.0
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

inspect dependencies for pterodactyl/panel

How to Check if You Are Affected

To determine whether your application is affected by CVE-2025-69198, inspect your project dependencies for Pterodactyl/panel:

inspect dependencies for pterodactyl/panel

Analyze the terminal output to locate any version of Pterodactyl/panel in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 1.12.0), your application is affected.

Note: Verify declared build manifests and deployed runtime container environments.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-413: Improper Resource Locking, where the product does not lock or does not correctly lock a resource when the product must have exclusive access to the resource. In Pterodactyl/panel, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Summary Pterodactyl implements rate limits that are applied to the total number of resources (e.g. databases, port allocations, or backups) that can exist for an individual server. These resource limits are applied on a per-server basis, and validated during the request cycle. However, it is possible for a malicious user to send a massive volume of requests at the same time that would create more resources than the server is allotted. This is because the validation occurs early in the request cycle and does not lock the target resource while it is processing. As a result sending a large volume of requests at the same time would lead all of those requests to validate as not using any of the target resources, and then all creating the resources at the same time. As a result a server would be able to create more databases, allocations, or backups than configured. ### Impact A malicious user is able to deny resources to other users on the system, and may be able to excessively consume the limited allocations for a node, or fill up backup space faster than is allowed by the system.

CVE-2025-69198 Affected Pterodactyl/panel Versions

1 component(s)
Fixed Versions:
1.12.0
Product / Package Ecosystem Affected Versions Fixed Version
pterodactyl/panel
 Packagist
< 1.12.0
1.12.0

References

GitHub Advisory / Wiki ADVISORY
https://github.com/pterodactyl/panel/security/advisories/GHSA-jw2v-cq5x-q68g
NVD — CVE-2025-69198 NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-69198
Security Fix Commit FIX COMMIT
https://github.com/pterodactyl/panel/commit/09caa0d4995bd924b53b9a9e9b4883ac27bd5607
Pterodactyl/panel Source Repository REPOSITORY
https://github.com/pterodactyl/panel

Frequently Asked Questions

What is CVE-2025-69198?
CVE-2025-69198 is a security vulnerability in Pterodactyl/panel involving Pterodactyl improperly locks resources allowing raced queries to create more resources than alloted under CWE-413: Improper Resource Locking.
Which Pterodactyl/panel versions are affected?
Affected versions include releases prior to 1.12.0 across affected packages: pterodactyl/panel.
What version fixes CVE-2025-69198?
Upgrading to 1.12.0 (or the latest patched release for your respective branch) resolves the vulnerability.
Is pterodactyl/panel affected?
Yes, pterodactyl/panel is affected in releases prior to 1.12.0. Upgrade your dependency to 1.12.0 or later.
What is the CVSS score of CVE-2025-69198?
CVE-2025-69198 has a CVSS v3.1 base score of 6.5 (MODERATE) with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.
What CWE is associated with CVE-2025-69198?
CVE-2025-69198 is classified under CWE-413: Improper Resource Locking (The product does not lock or does not correctly lock a resource when the product must have exclusive access to the resource.).
How can I check Packagist dependencies for CVE-2025-69198?
Run the dependency tree command: 'inspect dependencies for pterodactyl/panel'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-jw2v-cq5x-q68g",
  "modified" : "2026-02-02T22:21:44Z",
  "published" : "2026-01-20T16:30:17Z",
  "aliases" : [ "CVE-2025-69198" ],
  "summary" : "Pterodactyl improperly locks resources allowing raced queries to create more resources than alloted",
  "details" : "### Summary\nPterodactyl implements rate limits that are applied to the total number of resources (e.g. databases, port allocations, or backups) that can exist for an individual server. These resource limits are applied on a per-server basis, and validated during the request cycle.\n\nHowever, it is possible for a malicious user to send a massive volume of requests at the same time that would create more resources than the server is allotted. This is because the validation occurs early in the request cycle and does not lock the target resource while it is processing. As a result sending a large volume of requests at the same time would lead all of those requests to validate as not using any of the target resources, and then all creating the resources at the same time.\n\nAs a result a server would be able to create more databases, allocations, or backups than configured.\n\n### Impact\nA malicious user is able to deny resources to other users on the system, and may be able to excessively consume the limited allocations for a node, or fill up backup space faster than is allowed by the system.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
  }, {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "pterodactyl/panel"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "1.12.0"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/pterodactyl/panel/security/advisories/GHSA-jw2v-cq5x-q68g"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2025-69198"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/pterodactyl/panel/commit/09caa0d4995bd924b53b9a9e9b4883ac27bd5607"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/pterodactyl/panel"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-362", "CWE-400", "CWE-413", "CWE-667" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-01-20T16:30:17Z",
    "nvd_published_at" : "2026-01-19T19:16:03Z"
  }
}