github.com/pterodactyl/wings vulnerabilities (Go)

17 vulnerabilities.

• github.com/pterodactyl/wings Go Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service CVE-2026-52856 Public exploitFix available 7.5 HighJuly 31, 2026
• github.com/pterodactyl/wings Go Wings exposes node configuration secrets through egg configuration-file templating CVE-2026-52855 Fix available 9.9 CriticalJuly 31, 2026
• github.com/pterodactyl/wings Go Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM CVE-2026-52857 Fix available 5.5 MediumJuly 31, 2026
• github.com/pterodactyl/wings Go Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions CVE-2026-54593 Fix available 8.1 HighJuly 28, 2026
• github.com/pterodactyl/wings Go Pterodactyl Wings: Chmod operation can be used to change permissions of files outside of the server container GHSA-rhq6-9rgh-v45c Fix available 5.0 MediumJune 26, 2026
• github.com/pterodactyl/wings Go Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change GHSA-hr7j-63v7-vj7g Fix available 7.5 HighFebruary 17, 2026
• github.com/pterodactyl/wings Go Endless reprocessing/reupload of activity log data due to SQLite max parameters limit not being considered CVE-2026-21696 Fix available 8.3 HighJanuary 19, 2026
• github.com/pterodactyl/wings Go Pterodactyl Wings's websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks under certain circumstances CVE-2025-69199 Fix available 8.3 HighJanuary 19, 2026
• github.com/pterodactyl/wings Go Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced CVE-2025-68954 Fix available 7.5 HighJanuary 6, 2026
• github.com/pterodactyl/wings Go Arbitrary File Write/Read in Pterodactyl wings CVE-2024-34066 Fix available 8.5 HighMay 3, 2024
• github.com/pterodactyl/wings Go Server-side Request Forgery during remote file pull in Pterodactyl wings CVE-2024-34068 Fix available 6.4 MediumMay 3, 2024
• github.com/pterodactyl/wings Go Improper isolation of server file access in github.com/pterodactyl/wings CVE-2024-27102 Fix available 10.0 CriticalMarch 13, 2024
• github.com/pterodactyl/wings Go Wings vulnerable to escape to host from installation container CVE-2023-32080 Fix available 9.1 CriticalMay 10, 2023
• github.com/pterodactyl/wings Go Symbolic Link (Symlink) Following allowing the deletion of files and directories on the host system in wings CVE-2023-25168 Fix available 9.6 CriticalFebruary 8, 2023
• github.com/pterodactyl/wings Go Symbolic Link (Symlink) Following in github.com/pterodactyl/wings CVE-2023-25152 Fix available 8.4 HighFebruary 8, 2023
• github.com/pterodactyl/wings Go Unchecked hostname resolution could allow access to local network resources by users outside the local network GHSA-6rg3-8h8x-5xfv Fix available 6.4 MediumJune 23, 2021
• github.com/pterodactyl/wings Go Asymmetric Resource Consumption (Amplification) in Docker containers created by Wings CVE-2021-32699 Fix available 6.5 MediumJune 22, 2021