Why CVE-2025-49132 is not “just another panel bug” Every few years, defenders relearn the same lesson the hard way: the most dangerous execution surfaces aren’t always template engines or upload endpoints. Sometimes they’re the endpoints teams treat as “safe plumbing”—like localization, configuration, or metadata routes. CVE-2025-49132 is exactly that kind of failure mode. Per the … Continue reading CVE-2025-49132 PoC: The “Locale JSON” Endpoint That Turns Into Pre-Auth RCE