Wings

CVE-2026-61617 Aug 26, 21:56 HIGH PATCH This Week

Disk quota enforcement is absent from the SFTP write path in Pterodactyl Wings 1.13.2 and earlier, allowing any tenant with SFTP write access to a single server to exhaust the host node's entire physical disk. The flaw combines a stale, one-time cache check at file-handle open time with no per-write accounting, plus a logic gap that continues accepting SFTP writes to servers already stopped for quota violations. No public exploit has been identified at time of analysis, but exploitation requires only low-privilege SFTP credentials available to every legitimate tenant, making this a high-priority multi-tenant hosting risk.

CVE-2026-21696 Jan 19, 20:15 Go MEDIUM POC PATCH This Month

Wings for Pterodactyl versions 1.7.0 through 1.11.x fail to respect SQLite's maximum parameter limit when deleting activity log entries, allowing authenticated users to trigger a database error that prevents log cleanup and causes indefinite accumulation of records. This denial of service condition degrades panel performance and availability over time. Public exploit code exists for this vulnerability, and no patch is currently available.

CVE-2025-69199 Jan 19, 20:15 Go MEDIUM PATCH This Month

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to version 1.12.0, websockets within wings lack proper rate limiting and throttling. [CVSS 6.5 MEDIUM]

CVE-2025-68954 Jan 06, 01:16 LIB MEDIUM PATCH This Month

Pterodactyl is a free, open-source game server management panel. Versions 1.11.11 and below do not revoke active SFTP connections when a user is removed from a server instance or has their permissions changes with respect to file access over SFTP. [CVSS 5.4 MEDIUM]

CVE-2024-34068 May 03, 18:15 Go MEDIUM PATCH This Month

Pterodactyl wings is the server control plane for Pterodactyl Panel. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity.

CVE-2024-34066 May 03, 18:15 Go HIGH PATCH This Week

Pterodactyl wings is the server control plane for Pterodactyl Panel. Rated high severity (CVSS 8.4), this vulnerability is remotely exploitable, low attack complexity.

CVE-2024-27102 Mar 13, 21:15 Go HIGH PATCH This Week

Wings is the server control plane for Pterodactyl Panel. Rated high severity (CVSS 8.5), this vulnerability is remotely exploitable. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.

CVE-2023-32080 May 10, 21:15 Go HIGH PATCH This Week

Wings is the server control plane for Pterodactyl Panel. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2023-25168 Feb 09, 00:16 Go HIGH PATCH This Week

Wings is Pterodactyl's server control plane. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable.

CVE-2023-25152 Feb 08, 19:15 Go HIGH PATCH This Week

Wings is Pterodactyl's server control plane. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.

CVE-2021-32699 Jun 22, 20:15 Go MEDIUM PATCH This Month

Wings is the control plane software for the open source Pterodactyl game management system. Rated medium severity (CVSS 6.5), this vulnerability is low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.