CVE-2025-68954 pterodactyl CVE debrief

Who should care

Defenders managing Pterodactyl installations, especially those with multiple users and SFTP access, should assess exposure and apply the patch to prevent unauthorized file access. They should also verify SFTP connections and user permissions, especially for users with revoked access, and monitor SFTP connections and user permission changes for potential exploitation attempts. Additionally, defenders should prioritize patching to version 1.12.0 to fix the

Why it matters

CVE-2025-68954 is a high-severity vulnerability in Pterodactyl that allows users to access files via SFTP even after permission revocation. Defenders managing Pterodactyl installations should assess exposure, prioritize patching, and monitor SFTP connections to prevent unauthorized file access.

• Potential unauthorized file access via SFTP by users with revoked permissions
• Need to verify SFTP connections and user permissions to prevent exploitation
• Prioritization of patching to version 1.12.0 to fix the vulnerability
• Importance of monitoring SFTP connections and user permission changes for potential exploitation attempts

Technical summary

The vulnerability in Pterodactyl versions 1.11.11 and below allows users who have been removed from a server instance or had their SFTP permissions changed to remain connected and access files via SFTP. This requires the user to have been connected to SFTP at the time of permission revocation. The issue is fixed in version 1.12.0. Defenders should prioritize verifying SFTP connections and user permissions, especially for users with revoked access, and apply the patch to prevent unauthorized file access. The vulnerability has a high severity score of 7.5 and is classified as HIGH.

Defensive priority

Defenders should prioritize verifying SFTP connections and user permissions, especially for users with revoked access, and apply the patch to prevent unauthorized file access.

Recommended defensive actions

• Verify and revoke SFTP connections for users with revoked access
• Apply the patch by upgrading to Pterodactyl version 1.12.0
• Monitor SFTP connections and user permission changes for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, its impact, and the fixed version. However, additional information on exploitation or affected systems is limited. Defenders should verify SFTP connections and user permissions, especially for users with revoked access, and apply the patch to prevent unauthorized file access. The vulnerability requires the user to have been connected to SFTP at the time of permission revocation. Limited information is available on potential exploitation attempts or affected systems. To

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.