VulnerabilityAnalyzed

CVE-2025-68954

This allows a user that was already connected to SFTP to remain connected and access files even after their permissions are revoked.

HIGH 7.5EPSS 0.24%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.24%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Pterodactyl is a free, open-source game server management panel. Versions 1.11.11 and below do not revoke active SFTP connections when a user is removed from a server instance or has their permissions changes with respect to file access over SFTP. This allows a user that was already connected to SFTP to remain connected and access files even after their permissions are revoked. A user must have been connected to SFTP at the time of their permissions being revoked in order for this vulnerability to be exploited. This issue is fixed in version 1.12.0.

CVSS 4.0: 7.5 HIGHCVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.24% probability · 16th percentile
CISA KEV: Not listed
Weakness: CWE-613
Affected: pterodactyl/panel · pterodactyl/wings
Source: security-advisories@github.com

References

https://github.com/pterodactyl/panel/commit/2bd9d8baddb0e0606e4a9d5be402f48678ac88d5Patch
https://github.com/pterodactyl/panel/releases/tag/v1.12.0Product, Release Notes
https://github.com/pterodactyl/panel/security/advisories/GHSA-8c39-xppg-479cVendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.