HIGHPackagistGo
GHSA-8c39-xppg-479c· CVE-2025-68954, GO-2026-4283Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced
Modified: 2/3/2026
package
Go/github.com/pterodactyl/wings
pkg:go/github.com/pterodactyl/wings
HIGH8.1PackagistGo
GHSA-8r6w-3qq5-4p4r· CVE-2026-54593, GO-2026-6120Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions
Modified: 8/18/2026
HIGHPackagistGo
GHSA-hr7j-63v7-vj7g· GO-2026-4497Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change
Modified: 2/23/2026
MEDIUM6.5Go
GHSA-2497-gp99-2m74· CVE-2026-21696, GO-2026-4329Pterodactyl endlessly reprocesses/reuploads activity log data due to SQLite max parameters limit not being considered
Modified: 2/3/2026
CRITICAL9.9Go
GHSA-494h-9924-xww9· CVE-2024-27102, GO-2024-2642Pterodactyl Wings vulnerable to improper isolation of server file access
Modified: 9/10/2026
CRITICAL9.6Go
GHSA-66p8-j459-rq63· CVE-2023-25168, GO-2023-1555Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following resulting in deletion of files and directories on the host system
Modified: 2/4/2026
MEDIUM6.4Go
GHSA-6rg3-8h8x-5xfv· GO-2022-0389Unchecked hostname resolution could allow access to local network resources by users outside the local network
Modified: 2/4/2026
MEDIUM6.5Go
GHSA-8w7m-w749-rx98· CVE-2025-69199, GO-2026-4331Pterodactyl websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks
Modified: 2/3/2026
HIGH7.5Go
GHSA-ghrq-5wpp-hxx5· CVE-2026-52856, GO-2026-6156Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service
Modified: 8/18/2026
HIGH8.4Go
GHSA-gqmf-jqgv-v8fw· CVE-2024-34066, GO-2024-2814Pterodactyl Wings vulnerable to Arbitrary File Write/Read
Modified: 9/10/2026
MEDIUM6.5Go
GHSA-jj6m-r8jc-2gp7· CVE-2021-32699, GO-2022-0919Asymmetric Resource Consumption (Amplification) in Docker containers created by Wings
Modified: 7/8/2026
CRITICAL9.0Go
GHSA-p744-4q6p-hvc2· CVE-2023-32080, GO-2023-1768Wings vulnerable to escape to host from installation container
Modified: 9/10/2026
HIGH8.4Go
GHSA-p8r3-83r8-jwj5· CVE-2023-25152, GO-2023-1542Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following
Modified: 2/4/2026
CRITICAL9.9Go
GHSA-pfvc-3p5h-x7h6· CVE-2026-52855, GO-2026-6158Wings exposes node configuration secrets through egg configuration-file templating
Modified: 8/18/2026
MEDIUM5.5Go
GHSA-q6hh-gp44-4hcm· CVE-2026-52857, GO-2026-6159Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM
Modified: 8/18/2026
MEDIUM6.4Go
GHSA-qq22-jj8x-4wwv· CVE-2024-34068, GO-2024-2815Pterodactyl Wings vulnerable to Server-Side Request Forgery during remote file pull
Modified: 2/4/2026
MEDIUM5.0Go
GHSA-rhq6-9rgh-v45c· GO-2026-5814Pterodactyl Wings: Chmod operation can be used to change permissions of files outside of the server container
Modified: 7/7/2026
—Go
GO-2022-0389· GHSA-6rg3-8h8x-5xfvUnchecked hostname resolution could allow access to local network resources by users outside the local network in github.com/pterodactyl/wings
Modified: 3/3/2026
—Go
GO-2022-0919· CVE-2021-32699, GHSA-jj6m-r8jc-2gp7Asymmetric Resource Consumption (Amplification) in Docker containers created by Wings in github.com/pterodactyl/wings
Modified: 3/3/2026
—Go
GO-2023-1542· CVE-2023-25152, GHSA-p8r3-83r8-jwj5Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following in github.com/pterodactyl/wings
Modified: 3/3/2026
—Go
GO-2023-1555· CVE-2023-25168, GHSA-66p8-j459-rq63Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following resulting in deletion of files and directories on the host system in github.com/pterodactyl/wings
Modified: 3/3/2026
—Go
GO-2023-1768· CVE-2023-32080, GHSA-p744-4q6p-hvc2Wings vulnerable to escape to host from installation container in github.com/pterodactyl/wings
Modified: 3/3/2026
—Go
GO-2024-2642· CVE-2024-27102, GHSA-494h-9924-xww9Pterodactyl Wings vulnerable to improper isolation of server file access in github.com/pterodactyl/wings
Modified: 3/3/2026
—Go
GO-2024-2814· CVE-2024-34066, GHSA-gqmf-jqgv-v8fwPterodactyl Wings vulnerable to Arbitrary File Write/Read in github.com/pterodactyl/wings
Modified: 3/3/2026
—Go
GO-2024-2815· CVE-2024-34068, GHSA-qq22-jj8x-4wwvPterodactyl Wings vulnerable to Server-Side Request Forgery during remote file pull in github.com/pterodactyl/wings
Modified: 3/3/2026
—Go
GO-2026-4283· CVE-2025-68954, GHSA-8c39-xppg-479cPterodactyl does not revoke SFTP access when server is deleted or permissions reduced in github.com/pterodactyl/wings
Modified: 3/3/2026
—Go
GO-2026-4329· CVE-2026-21696, GHSA-2497-gp99-2m74Pterodactyl endlessly reprocesses/reuploads activity log data due to SQLite max parameters limit not being considered in github.com/pterodactyl/wings
Modified: 3/3/2026
—Go
GO-2026-4331· CVE-2025-69199, GHSA-8w7m-w749-rx98Pterodactyl websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks in github.com/pterodactyl/wings
Modified: 3/3/2026
—Go
GO-2026-4497· GHSA-hr7j-63v7-vj7gPterodactyl Panel's SFTP sessions remain active after user account deletion or password change in github.com/pterodactyl/wings
Modified: 2/23/2026
—Go
GO-2026-5814· GHSA-rhq6-9rgh-v45cPterodactyl Wings: Chmod operation can be used to change permissions of files outside of the server container in github.com/pterodactyl/wings
Modified: 7/7/2026
—Go
GO-2026-6120· CVE-2026-54593, GHSA-8r6w-3qq5-4p4rPterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions in github.com/pterodactyl/wings
Modified: 8/18/2026
—Go
GO-2026-6156· CVE-2026-52856, GHSA-ghrq-5wpp-hxx5Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service in github.com/pterodactyl/wings
Modified: 8/18/2026
—Go
GO-2026-6158· CVE-2026-52855, GHSA-pfvc-3p5h-x7h6Wings exposes node configuration secrets through egg configuration-file templating in github.com/pterodactyl/wings
Modified: 8/18/2026
—Go
GO-2026-6159· CVE-2026-52857, GHSA-q6hh-gp44-4hcmWings: Maliciously or erroneously created parsed config files can cause wings process to OOM in github.com/pterodactyl/wings
Modified: 8/18/2026