GoPackage

github.com/pterodactyl/wings

14 known vulnerabilities (4 critical, 7 high, 3 medium), with the versions each affects and the releases that fix them.

Latest release: v1.13.4 (Oct 14, 2026): no advisory affects it
Newest unaffected release: v1.13.4 (Oct 14, 2026), the latest release
Advisories: 14 · 4 critical, 7 high, 3 medium

Releases: 82 since v1.0.0 (Oct 11, 2020)
Registry: pkg.go.dev
Releases read: Nov 8, 2026

Version timeline

CVE-2026-52856
Affects v1.0.0-alpha.1 to v1.12.3 (v1.13.0 is outside it)
CVE-2026-52855
Affects v1.0.0-alpha.1 to v1.12.2 (v1.12.3 is outside it)
CVE-2026-52857
Affects v1.0.0-alpha.1 to v1.12.3 (v1.13.0 is outside it)
CVE-2026-54593
Affects v1.0.0-alpha.1 to v1.12.1 (v1.12.2 is outside it)
CVE-2026-21696
Affects v1.7.0 to v1.11.13 (v1.12.0 is outside it)
CVE-2025-69199
Affects v1.0.0-alpha.1 to v1.11.13 (v1.12.0 is outside it)
CVE-2025-68954
Affects v1.0.0-alpha.1 to v1.11.13 (v1.12.0 is outside it)
CVE-2024-34066
Affects v1.0.0-alpha.1 to v1.11.11 (v1.11.12 is outside it)
CVE-2024-34068
Affects v1.0.0-alpha.1 to v1.11.11 (v1.11.12 is outside it)
CVE-2024-27102
Affects v1.0.0-alpha.1 to v1.11.8 (v1.11.9 is outside it)
CVE-2023-32080
Affects v1.0.0-alpha.1 to v1.7.4 (v1.7.5 is outside it); v1.11.0 to v1.11.5 (v1.11.6 is outside it)
CVE-2023-25168
Affects v1.0.0-alpha.1 to v1.7.3 (v1.7.4 is outside it); v1.11.0 to v1.11.3 (v1.11.4 is outside it)

Show all 14 advisoriesShow fewer advisories

CVE-2023-25152
Affects v1.0.0-alpha.1 to v1.7.2 (v1.7.3 is outside it); v1.11.0 to v1.11.2 (v1.11.3 is outside it)
CVE-2021-32699
Affects v1.0.0-alpha.1 to v1.4.3 (v1.4.4 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 14

CVE-2026-52856High 7.5
Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service
Affected: fixed in 1.13.0.
Fixed in v1.13.0 (released Jun 14, 2026, 47 days before disclosure).
The latest release, v1.13.4, is not affected.
CVE-2026-52855Critical 9.9
Wings exposes node configuration secrets through egg configuration-file templating
Affected: fixed in 1.12.3.
Fixed in v1.12.3 (released May 29, 2026, 63 days before disclosure).
The latest release, v1.13.4, is not affected.
CVE-2026-52857Medium 5.5
Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM
Affected: fixed in 1.13.0.
Fixed in v1.13.0 (released Jun 14, 2026, 47 days before disclosure).
The latest release, v1.13.4, is not affected.
CVE-2026-54593High 8.1
Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions
Affected: fixed in 1.12.2.
Fixed in v1.12.2 (released May 23, 2026, 66 days before disclosure).
The latest release, v1.13.4, is not affected.
CVE-2026-21696High 8.3
Endless reprocessing/reupload of activity log data due to SQLite max parameters limit not being considered
Affected: from 1.7.0, fixed in 1.12.0.
Fixed in v1.12.0 (released Jan 6, 2026, 13 days before disclosure).
The latest release, v1.13.4, is not affected.
CVE-2025-69199High 8.3
Pterodactyl Wings's websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks under certain circumstances
Affected: fixed in 1.12.0.
Fixed in v1.12.0 (released Jan 6, 2026, 13 days before disclosure).
The latest release, v1.13.4, is not affected.
CVE-2025-68954High 7.5
Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced
Affected: fixed in 1.12.0.
Fixed in v1.12.0 (released Jan 6, 2026, the day of disclosure).
The latest release, v1.13.4, is not affected.
CVE-2024-34066High 8.5
Arbitrary File Write/Read in Pterodactyl wings
Affected: fixed in 1.11.12.
Fixed in v1.11.12 (released May 3, 2024, the day of disclosure).
The latest release, v1.13.4, is not affected.
CVE-2024-34068Medium 6.4
Server-side Request Forgery during remote file pull in Pterodactyl wings
Affected: fixed in 1.11.12.
Fixed in v1.11.12 (released May 3, 2024, the day of disclosure).
The latest release, v1.13.4, is not affected.
CVE-2024-27102Critical 10.0
Improper isolation of server file access in github.com/pterodactyl/wings
Affected: fixed in 1.11.9.
Fixed in v1.11.9 (released Mar 13, 2024, the day of disclosure).
The latest release, v1.13.4, is not affected.
CVE-2023-32080Critical 9.1
Wings vulnerable to escape to host from installation container
Affected: fixed in 1.7.5; from 1.11.0, fixed in 1.11.6; fixed in 1.7.5; from 1.11.0, fixed in 1.11.6.
Fixed in v1.7.5 (released May 10, 2023, the day of disclosure) and v1.11.6 (released May 10, 2023, the day of disclosure).
The latest release, v1.13.4, is not affected.
CVE-2023-25168Critical 9.6
Symbolic Link (Symlink) Following allowing the deletion of files and directories on the host system in wings
Affected: fixed in 1.7.4; from 1.11.0, fixed in 1.11.4; fixed in 1.7.4; from 1.11.0, fixed in 1.11.4.
Fixed in v1.7.4 (released Feb 8, 2023, the day of disclosure) and v1.11.4 (released Feb 8, 2023, the day of disclosure).
The latest release, v1.13.4, is not affected.
CVE-2023-25152High 8.4
Symbolic Link (Symlink) Following in github.com/pterodactyl/wings
Affected: fixed in 1.7.3; from 1.11.0, fixed in 1.11.3; fixed in 1.7.3; from 1.11.0, fixed in 1.11.3.
Fixed in v1.7.3 (released Feb 8, 2023, the day of disclosure) and v1.11.3 (released Feb 8, 2023, the day of disclosure).
The latest release, v1.13.4, is not affected.
CVE-2021-32699Medium 6.5
Asymmetric Resource Consumption (Amplification) in Docker containers created by Wings
Affected: fixed in 1.4.4.
Fixed in v1.4.4 (released Jun 21, 2021, 1 day before disclosure).
The latest release, v1.13.4, is not affected.