CVE-2025-68954CWE-613

CVE-2025-68954

Medium · published January 6, 2026

CVSS v3.1
5.4
EPSS
0%
Percentile
14.5
In the wild
Unconfirmed
What it is

Pterodactyl is a free, open-source game server management panel. Versions 1.11.11 and below do not revoke active SFTP connections when a user is removed from a server instance or has their permissions changes with respect to file access over SFTP. This allows a user that was already connected to SFTP to remain connected and access files even after their permissions are revoked. A user must have been connected to SFTP at the time of their permissions being revoked in order for this vulnerability to be exploited. This issue is fixed in version 1.12.0.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00242 · 14.5th percentile
Weakness
CWE-613 · Insufficient Session Expiration
Published
2026-01-06T06:16Z
Affected products (2)
ProductVersionsFixed in
pterodactyl/panel< 1.12.01.12.0
pterodactyl/wings< 1.12.01.12.0
References (3)
https://github.com/pterodactyl/panel/commit/2bd9d8baddb0e0606e4a9d5be402f48678ac88d5 · [email protected]https://github.com/pterodactyl/panel/releases/tag/v1.12.0 · [email protected]https://github.com/pterodactyl/panel/security/advisories/GHSA-8c39-xppg-479c · [email protected]
EPSS history
Timeline
  • 06 JAN 00:31Z
    Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced
    cvelistv5