EUVD-2026-51569
GHSA-ghrq-5wpp-hxx5
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Pre-authentication network panic with no credential requirement; only availability is impacted via process crash, no confidentiality or integrity consequence.
Primary rating from Vendor (https://github.com/pterodactyl/wings).
CVSS VectorVendor: https://github.com/pterodactyl/wings
Lifecycle Timeline
3DescriptionCVE.org
Summary
A maliciously crafted packet received & parsed during the SFTP connection handshake will cause a Go panic.
Impact
All wings users with an open SFTP port.
Workarounds
Close SFTP port.
AnalysisAI
Pterodactyl Wings before v1.13.0 crashes when its SFTP handler receives a crafted packet with fewer than 4 bytes in the payload during the SSH connection handshake, triggering a Go runtime index-out-of-bounds panic that kills the Wings daemon. The crash is exploitable by any unauthenticated network attacker who can reach the SFTP port, requiring no credentials because the vulnerable slice operation executes prior to authentication. No public exploit code exists at time of analysis, but the patch diff makes the trigger trivially reproducible: any packet with a short payload in the SSH subsystem channel request is sufficient.
Technical ContextAI
Wings is the Go-language server-side daemon for the Pterodactyl game server management panel (CPE: pkg:go/github.com/pterodactyl/wings). The flaw lives in sftp/server.go inside the AcceptInbound function, which processes incoming SSH channel requests during SFTP subsystem negotiation. The original code evaluated string(req.Payload[4:]) directly against the string 'sftp' without first checking that req.Payload had at least 4 bytes, violating CWE-20 (Improper Input Validation). In Go, slicing past the length of a byte slice causes an immediate runtime panic, which in a server process terminates the goroutine - and in Wings' architecture, crashes the entire daemon. The one-line fix adds the guard len(req.Payload) >= 4 as a short-circuit condition, preventing the invalid slice.
RemediationAI
Upgrade Pterodactyl Wings to v1.13.0, the vendor-released patch available at https://github.com/pterodactyl/wings/releases/tag/v1.13.0 (fix commit: 8e49c7c0eda815d3ada171831876a1c14c493026). If immediate upgrade is operationally blocked, close or firewall the Wings SFTP port as the vendor-documented workaround - this fully eliminates the attack surface but disables SFTP-based file transfers for server administrators, which may impact panel usability. A narrower compensating control is restricting SFTP port access to trusted management IP ranges only, preserving functionality for authorized staff while removing exposure to arbitrary attackers; this reduces but does not eliminate risk if trusted IP ranges are broad or shared.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today