pterodactyl

6 results · Clear filters · Feed

• Critical 9.9
  CVE-2026-52855

  Wings exposes node configuration secrets through egg configuration-file templating

  Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.12.3, {{config.}} placeholders in egg configuration-file templates allow a low-privileged user to read {{config.token}}, {{config.token_id}}, and {…

  pterodactyl wings github.com/pterodactyl/wings Go
  Jul 31, 2026
• Critical 9.2
  CVE-2026-26016

  Pterodactyl Panel Allows Cross-Node Server Configuration Disclosure via Remote API Missing Authorization

  Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to version 1.12.1, a missing authorization check in multiple controllers allows any user with access to a node secret token to fetch information about a…

  pterodactyl panel pterodactyl/panel Packagist
  Feb 19, 2026
• Critical 10.0
  CVE-2025-49132 Public exploit Scanner template EPSS 54%

  Pterodactyl Panel Allows Unauthenticated Arbitrary Remote Code Execution

  Pterodactyl is a free, open-source game server management panel. Prior to version 1.11.11, using the /locales/locale.json with the locale and namespace query parameters, a malicious actor is able to execute arbitrary code without being authenticated. With the…

  pterodactyl panel pterodactyl/panel Packagist
  Jun 20, 2025
• Critical 10.0
  CVE-2024-27102

  Improper isolation of server file access in github.com/pterodactyl/wings

  Wings is the server control plane for Pterodactyl Panel. This vulnerability impacts anyone running the affected versions of Wings. The vulnerability can potentially be used to access files and directories on the host system. The full scope of impact is exactl…

  pterodactyl wings github.com/pterodactyl/wings Go
  Mar 13, 2024
• Critical 9.1
  CVE-2023-32080

  Wings vulnerable to escape to host from installation container

  Wings is the server control plane for Pterodactyl Panel. A vulnerability affecting versions prior to 1.7.5 and versions 1.11.0 prior to 1.11.6 impacts anyone running the affected versions of Wings. This vulnerability can be used to gain access to the host sys…

  pterodactyl wings github.com/pterodactyl/wings Go
  May 10, 2023
• Critical 9.6
  CVE-2023-25168

  Symbolic Link (Symlink) Following allowing the deletion of files and directories on the host system in wings

  Wings is Pterodactyl's server control plane. This vulnerability can be used to delete files and directories recursively on the host system. This vulnerability can be combined with `GHSA-p8r3-83r8-jwj5` to overwrite files on the host system. In order to use th…

  pterodactyl wings github.com/pterodactyl/wings Go
  Feb 8, 2023