pterodactyl/wings Security Advisories | GitStock

high2026-07-31

Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service

GHSA-ghrq-5wpp-hxx5 · CVE-2026-52856

critical2026-07-31

Wings exposes node configuration secrets through egg configuration-file templating

GHSA-pfvc-3p5h-x7h6 · CVE-2026-52855

medium2026-07-31

Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM

GHSA-q6hh-gp44-4hcm · CVE-2026-52857

medium2026-06-26

Pterodactyl Wings: Chmod operation can be used to change permissions of files outside of the server container

GHSA-rhq6-9rgh-v45c

high2026-01-20

Pterodactyl endlessly reprocesses/reuploads activity log data due to SQLite max parameters limit not being considered

GHSA-2497-gp99-2m74 · CVE-2026-21696

medium2024-05-03

Pterodactyl Wings vulnerable to Server-Side Request Forgery during remote file pull

GHSA-qq22-jj8x-4wwv · CVE-2024-34068

high2024-05-03

Pterodactyl Wings vulnerable to Arbitrary File Write/Read

GHSA-gqmf-jqgv-v8fw · CVE-2024-34066

critical2024-03-15

Pterodactyl Wings vulnerable to improper isolation of server file access

GHSA-494h-9924-xww9 · CVE-2024-27102

critical2023-05-11

Wings vulnerable to escape to host from installation container

GHSA-p744-4q6p-hvc2 · CVE-2023-32080

critical2023-02-10

Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following resulting in deletion of files and directories on the host system

GHSA-66p8-j459-rq63 · CVE-2023-25168

high2023-02-08

Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following

GHSA-p8r3-83r8-jwj5 · CVE-2023-25152