Security
فارسی
All products

github.com/pterodactyl/wings

Go · Package
17 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
Pterodactyl Wings vulnerable to Arbitrary File Write/ReadCVE-2024-34066 · GHSA-GQMF-JQGV-V8FWVersion ranges need review. github.com/pterodactyl/wings Go High Fix reported
Pterodactyl Wings vulnerable to improper isolation of server file accessCVE-2024-27102 · GHSA-494H-9924-XWW9Version ranges need review. github.com/pterodactyl/wings Go Critical Fix reported
Wings vulnerable to escape to host from installation containerCVE-2023-32080 · GHSA-P744-4Q6P-HVC2Version ranges need review. github.com/pterodactyl/wings Go Critical Fix reported
Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissionsCVE-2026-54593 · GHSA-8R6W-3QQ5-4P4RVersion ranges need review. pterodactyl/panelgithub.com/pterodactyl/wings ComposerGo High Fix reported
Wings exposes node configuration secrets through egg configuration-file templatingCVE-2026-52855 · GHSA-PFVC-3P5H-X7H6Version ranges need review. github.com/pterodactyl/wings Go Critical Fix reported
Wings: Maliciously or erroneously created parsed config files can cause wings process to OOMCVE-2026-52857 · GHSA-Q6HH-GP44-4HCMVersion ranges need review. github.com/pterodactyl/wings Go Medium Fix reported
Wings: Maliciously crafted packet during SFTP connection handshake causes denial of serviceCVE-2026-52856 · GHSA-GHRQ-5WPP-HXX5Version ranges need review. github.com/pterodactyl/wings Go High Fix reported
Asymmetric Resource Consumption (Amplification) in Docker containers created by Wings CVE-2021-32699 · GHSA-JJ6M-R8JC-2GP7Version ranges need review. github.com/pterodactyl/wings Go Medium Fix reported
Pterodactyl Wings: Chmod operation can be used to change permissions of files outside of the server containerGHSA-RHQ6-9RGH-V45C · GO-2026-5814Version ranges need review. github.com/pterodactyl/wings Go Medium Fix reported
Pterodactyl does not revoke SFTP access when server is deleted or permissions reducedCVE-2025-68954 · GHSA-8C39-XPPG-479CVersion ranges need review. pterodactyl/panelgithub.com/pterodactyl/wings ComposerGo High Fix reported
Pterodactyl websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacksCVE-2025-69199 · GHSA-8W7M-W749-RX98Version ranges need review. github.com/pterodactyl/wings Go High Fix reported
Pterodactyl endlessly reprocesses/reuploads activity log data due to SQLite max parameters limit not being consideredCVE-2026-21696 · GHSA-2497-GP99-2M74Version ranges need review. github.com/pterodactyl/wings Go High Fix reported
Pterodactyl Wings vulnerable to Server-Side Request Forgery during remote file pullCVE-2024-34068 · GHSA-QQ22-JJ8X-4WWVVersion ranges need review. github.com/pterodactyl/wings Go Medium Fix reported
Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following resulting in deletion of files and directories on the host systemCVE-2023-25168 · GHSA-66P8-J459-RQ63Version ranges need review. github.com/pterodactyl/wings Go Critical Fix reported
Unchecked hostname resolution could allow access to local network resources by users outside the local networkGHSA-6RG3-8H8X-5XFV · GO-2022-0389Version ranges need review. github.com/pterodactyl/wings Go Medium Fix reported
Pterodactyl Wings contains UNIX Symbolic Link (Symlink) FollowingCVE-2023-25152 · GHSA-P8R3-83R8-JWJ5Version ranges need review. github.com/pterodactyl/wings Go High Fix reported
Pterodactyl Panel's SFTP sessions remain active after user account deletion or password changeGHSA-HR7J-63V7-VJ7G · GO-2026-4497Version ranges need review. pterodactyl/panelgithub.com/pterodactyl/wings ComposerGo High Fix reported