—
GO-2023-1555
Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following resulting in deletion of files and directories on the host system in github.com/pterodactyl/wings
Quick fix
GO-2023-1555 — github.com/pterodactyl/wings: upgrade to the fixed version with the command below.
go get github.com/pterodactyl/wings@v1.7.4Details
Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following resulting in deletion of files and directories on the host system in github.com/pterodactyl/wings
Are you affected?
Enter the version of the package you're using.
Affected packages
Go/github.com/pterodactyl/wings
Introduced in:
0Fixed in: 1.7.4Fix
go get github.com/pterodactyl/wings@v1.7.4References
- https://github.com/pterodactyl/wings/security/advisories/GHSA-66p8-j459-rq63[ADVISORY]
- https://nvd.nist.gov/vuln/detail/CVE-2023-25168[ADVISORY]
- https://github.com/pterodactyl/wings/commit/429ac62dba22997a278bc709df5ac00a5a25d83d[FIX]
- https://github.com/pterodactyl/wings/security/advisories/GHSA-p8r3-83r8-jwj5[WEB]