Pterodactyl Wings vulnerabilities

• pterodactyl wings Pterodactyl Wings SFTP write path does not enforce disk quota, allowing node-wide disk exhaustion CVE-2026-61617 7.7 HighAugust 26, 2026
• pterodactyl wings Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service CVE-2026-52856 Public exploitFix available 7.5 HighJuly 31, 2026
• pterodactyl wings Wings exposes node configuration secrets through egg configuration-file templating CVE-2026-52855 Fix available 9.9 CriticalJuly 31, 2026
• pterodactyl wings Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM CVE-2026-52857 Fix available 5.5 MediumJuly 31, 2026
• pterodactyl wings Endless reprocessing/reupload of activity log data due to SQLite max parameters limit not being considered CVE-2026-21696 Fix available 8.3 HighJanuary 19, 2026
• convoypanel panel, pterodactyl wings +1 more Pterodactyl Wings's websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks under certain circumstances CVE-2025-69199 Fix available 8.3 HighJanuary 19, 2026
• convoypanel panel, pterodactyl wings +1 more Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced CVE-2025-68954 Fix available 7.5 HighJanuary 6, 2026
• pterodactyl wings Arbitrary File Write/Read in Pterodactyl wings CVE-2024-34066 Fix available 8.5 HighMay 3, 2024
• pterodactyl wings Server-side Request Forgery during remote file pull in Pterodactyl wings CVE-2024-34068 Fix available 6.4 MediumMay 3, 2024
• pterodactyl wings Improper isolation of server file access in github.com/pterodactyl/wings CVE-2024-27102 Fix available 10.0 CriticalMarch 13, 2024
• pterodactyl wings Wings vulnerable to escape to host from installation container CVE-2023-32080 Fix available 9.1 CriticalMay 10, 2023
• pterodactyl wings Symbolic Link (Symlink) Following allowing the deletion of files and directories on the host system in wings CVE-2023-25168 Fix available 9.6 CriticalFebruary 8, 2023
• pterodactyl wings Symbolic Link (Symlink) Following in github.com/pterodactyl/wings CVE-2023-25152 Fix available 8.4 HighFebruary 8, 2023
• pterodactyl wings Asymmetric Resource Consumption (Amplification) in Docker containers created by Wings CVE-2021-32699 Fix available 6.5 MediumJune 22, 2021