EUVD-2026-66776Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
SFTP write access (PR:L) is the only prerequisite; scope changes because disk exhaustion crashes co-hosted servers; no confidentiality or integrity impact applies.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Wings is the server control plane for the Pterodactyl game-server management panel. In versions up to and including 1.13.2, the SFTP write path does not enforce a server's disk quota during a transfer, allowing a tenant with SFTP write access to a single server to exhaust the host node's physical disk and take down every server on it. Wings checks available space only once, as a boolean, when the write handle is opened, using a stale cached usage value and without knowing the size of the incoming data, and it then returns a raw, unaccounted file handle that is never re-checked as the transfer proceeds. A single upload can therefore be written without bound, far beyond the configured disk limit, until the node's disk is full, and because a server stopped for exceeding its limit is not treated as suspended, SFTP writes are still accepted even after the quota is already exceeded. This issue is fixed in version 1.13.3.
AnalysisAI
Disk quota enforcement is absent from the SFTP write path in Pterodactyl Wings 1.13.2 and earlier, allowing any tenant with SFTP write access to a single server to exhaust the host node's entire physical disk. The flaw combines a stale, one-time cache check at file-handle open time with no per-write accounting, plus a logic gap that continues accepting SFTP writes to servers already stopped for quota violations. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must hold valid SFTP write access (specifically the Wings SFTP write permission, such as PermissionFileCreate) to at least one server hosted on the target node - access routinely granted to all paying platform tenants. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 7.7 High with vector AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H accurately captures the risk profile. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Wings to version 1.13.3, which is confirmed as the fix release per the upstream security advisory at https://github.com/pterodactyl/wings/security/advisories/GHSA-8j54-xcwx-597p and the associated patch commit at https://github.com/pterodactyl/wings/commit/da1a216cfff5867fa66be32cb1edb93e37fd71ff. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Pterodactyl Wings instances to identify those running version 1.13.2 or earlier, and implement filesystem-level disk quotas per tenant. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Wings for Pterodactyl versions 1.7.0 through 1.11.x fail to respect SQLite's maximum parameter limit when deleting activ
Wings is the server control plane for Pterodactyl Panel. Rated high severity (CVSS 8.8), this vulnerability is remotely
Wings is Pterodactyl's server control plane. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable,
Wings is the server control plane for Pterodactyl Panel. Rated high severity (CVSS 8.5), this vulnerability is remotely
Pterodactyl wings is the server control plane for Pterodactyl Panel. Rated high severity (CVSS 8.4), this vulnerability
Wings is Pterodactyl's server control plane. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable.
Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to version 1.
Wings is the control plane software for the open source Pterodactyl game management system. Rated medium severity (CVSS
Pterodactyl wings is the server control plane for Pterodactyl Panel. Rated medium severity (CVSS 6.4), this vulnerabilit
Pterodactyl is a free, open-source game server management panel. Versions 1.11.11 and below do not revoke active SFTP co
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today