CVE-2025-68954

MediumCVSS 5.4/10Last modified Oct 7, 2026

Description

Pterodactyl is a free, open-source game server management panel. Versions 1.11.11 and below do not revoke active SFTP connections when a user is removed from a server instance or has their permissions changes with respect to file access over SFTP. This allows a user that was already connected to SFTP to remain connected and access files even after their permissions are revoked. A user must have been connected to SFTP at the time of their permissions being revoked in order for this vulnerability to be exploited. This issue is fixed in version 1.12.0.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-613

Affected software

VendorProductVersions
pterodactylpanel< 1.12.0

References

Timeline

Published
Jan 6, 2026
Last modified
Oct 7, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-689554.7Multi-thread race condition vulnerability in the card framework module. Impact: Successful exploitation of this vulnerability may affect avCVE-2025-689564.7Multi-thread race condition vulnerability in the card framework module. Impact: Successful exploitation of this vulnerability may affect avaCVE-2025-689574.7Multi-thread race condition vulnerability in the card framework module. Impact: Successful exploitation of this vulnerability may affect avaCVE-2025-689584.7Multi-thread race condition vulnerability in the card framework module. Impact: Successful exploitation of this vulnerability may affect avaCVE-2025-689595.5Permission verification bypass vulnerability in the media library module. Impact: Successful exploitation of this vulnerability may affect sCVE-2025-68968.8A vulnerability classified as critical has been found in D-Link DI-7300G+ 19.12.25A1. Affected is an unknown function of the file wget_test.CVE-2025-689604.7Multi-thread race condition vulnerability in the video framework module. Impact: Successful exploitation of this vulnerability may affect avCVE-2025-689614.7Multi-thread race condition vulnerability in the camera framework module. Impact: Successful exploitation of this vulnerability may affect aCVE-2025-689624.7Multi-thread race condition vulnerability in the camera framework module. Impact: Successful exploitation of this vulnerability may affect aCVE-2025-689635.3Man-in-the-middle attack vulnerability in the Clone module. Impact: Successful exploitation of this vulnerability may affect service confideCVE-2025-689645.5Data verification vulnerability in the HiView module. Impact: Successful exploitation of this vulnerability may affect availability.CVE-2025-689655.5Permission control vulnerability in the Notepad module. Impact: Successful exploitation of this vulnerability may affect service confidentia
CVE-2025-68954: Medium severity, CVSS 5.4 | Vulnix