# github.com/pterodactyl/wings (Go) vulnerabilities 14 known vulnerabilities (4 critical, 7 high, 3 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: v1.13.4 (Oct 14, 2026): no advisory affects it - Newest unaffected release: v1.13.4 (Oct 14, 2026), the latest release - Releases: 82 since v1.0.0 (Oct 11, 2020) - Registry: https://pkg.go.dev/github.com/pterodactyl/wings - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-52856: v1.0.0-alpha.1 to v1.12.3 (v1.13.0 is outside it) - CVE-2026-52855: v1.0.0-alpha.1 to v1.12.2 (v1.12.3 is outside it) - CVE-2026-52857: v1.0.0-alpha.1 to v1.12.3 (v1.13.0 is outside it) - CVE-2026-54593: v1.0.0-alpha.1 to v1.12.1 (v1.12.2 is outside it) - CVE-2026-21696: v1.7.0 to v1.11.13 (v1.12.0 is outside it) - CVE-2025-69199: v1.0.0-alpha.1 to v1.11.13 (v1.12.0 is outside it) - CVE-2025-68954: v1.0.0-alpha.1 to v1.11.13 (v1.12.0 is outside it) - CVE-2024-34066: v1.0.0-alpha.1 to v1.11.11 (v1.11.12 is outside it) - CVE-2024-34068: v1.0.0-alpha.1 to v1.11.11 (v1.11.12 is outside it) - CVE-2024-27102: v1.0.0-alpha.1 to v1.11.8 (v1.11.9 is outside it) - CVE-2023-32080: v1.0.0-alpha.1 to v1.7.4 (v1.7.5 is outside it); v1.11.0 to v1.11.5 (v1.11.6 is outside it) - CVE-2023-25168: v1.0.0-alpha.1 to v1.7.3 (v1.7.4 is outside it); v1.11.0 to v1.11.3 (v1.11.4 is outside it) - CVE-2023-25152: v1.0.0-alpha.1 to v1.7.2 (v1.7.3 is outside it); v1.11.0 to v1.11.2 (v1.11.3 is outside it) - CVE-2021-32699: v1.0.0-alpha.1 to v1.4.3 (v1.4.4 is outside it) ## Advisories (14) ### [CVE-2026-52856](https://cve.now/CVE-2026-52856): Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service - Severity: High 7.5 - Published: Jul 31, 2026 - Affected: fixed in 1.13.0. - Fixed in v1.13.0 (released Jun 14, 2026, 47 days before disclosure). - The latest release, v1.13.4, is not affected. ### [CVE-2026-52855](https://cve.now/CVE-2026-52855): Wings exposes node configuration secrets through egg configuration-file templating - Severity: Critical 9.9 - Published: Jul 31, 2026 - Affected: fixed in 1.12.3. - Fixed in v1.12.3 (released May 29, 2026, 63 days before disclosure). - The latest release, v1.13.4, is not affected. ### [CVE-2026-52857](https://cve.now/CVE-2026-52857): Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM - Severity: Medium 5.5 - Published: Jul 31, 2026 - Affected: fixed in 1.13.0. - Fixed in v1.13.0 (released Jun 14, 2026, 47 days before disclosure). - The latest release, v1.13.4, is not affected. ### [CVE-2026-54593](https://cve.now/CVE-2026-54593): Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted \`file.create\` permissions - Severity: High 8.1 - Published: Jul 28, 2026 - Affected: fixed in 1.12.2. - Fixed in v1.12.2 (released May 23, 2026, 66 days before disclosure). - The latest release, v1.13.4, is not affected. ### [CVE-2026-21696](https://cve.now/CVE-2026-21696): Endless reprocessing/reupload of activity log data due to SQLite max parameters limit not being considered - Severity: High 8.3 - Published: Jan 19, 2026 - Affected: from 1.7.0, fixed in 1.12.0. - Fixed in v1.12.0 (released Jan 6, 2026, 13 days before disclosure). - The latest release, v1.13.4, is not affected. ### [CVE-2025-69199](https://cve.now/CVE-2025-69199): Pterodactyl Wings's websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks under certain circumstances - Severity: High 8.3 - Published: Jan 19, 2026 - Affected: fixed in 1.12.0. - Fixed in v1.12.0 (released Jan 6, 2026, 13 days before disclosure). - The latest release, v1.13.4, is not affected. ### [CVE-2025-68954](https://cve.now/CVE-2025-68954): Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced - Severity: High 7.5 - Published: Jan 6, 2026 - Affected: fixed in 1.12.0. - Fixed in v1.12.0 (released Jan 6, 2026, the day of disclosure). - The latest release, v1.13.4, is not affected. ### [CVE-2024-34066](https://cve.now/CVE-2024-34066): Arbitrary File Write/Read in Pterodactyl wings - Severity: High 8.5 - Published: May 3, 2024 - Affected: fixed in 1.11.12. - Fixed in v1.11.12 (released May 3, 2024, the day of disclosure). - The latest release, v1.13.4, is not affected. ### [CVE-2024-34068](https://cve.now/CVE-2024-34068): Server-side Request Forgery during remote file pull in Pterodactyl wings - Severity: Medium 6.4 - Published: May 3, 2024 - Affected: fixed in 1.11.12. - Fixed in v1.11.12 (released May 3, 2024, the day of disclosure). - The latest release, v1.13.4, is not affected. ### [CVE-2024-27102](https://cve.now/CVE-2024-27102): Improper isolation of server file access in github.com/pterodactyl/wings - Severity: Critical 10.0 - Published: Mar 13, 2024 - Affected: fixed in 1.11.9. - Fixed in v1.11.9 (released Mar 13, 2024, the day of disclosure). - The latest release, v1.13.4, is not affected. ### [CVE-2023-32080](https://cve.now/CVE-2023-32080): Wings vulnerable to escape to host from installation container - Severity: Critical 9.1 - Published: May 10, 2023 - Affected: fixed in 1.7.5; from 1.11.0, fixed in 1.11.6; fixed in 1.7.5; from 1.11.0, fixed in 1.11.6. - Fixed in v1.7.5 (released May 10, 2023, the day of disclosure) and v1.11.6 (released May 10, 2023, the day of disclosure). - The latest release, v1.13.4, is not affected. ### [CVE-2023-25168](https://cve.now/CVE-2023-25168): Symbolic Link (Symlink) Following allowing the deletion of files and directories on the host system in wings - Severity: Critical 9.6 - Published: Feb 8, 2023 - Affected: fixed in 1.7.4; from 1.11.0, fixed in 1.11.4; fixed in 1.7.4; from 1.11.0, fixed in 1.11.4. - Fixed in v1.7.4 (released Feb 8, 2023, the day of disclosure) and v1.11.4 (released Feb 8, 2023, the day of disclosure). - The latest release, v1.13.4, is not affected. ### [CVE-2023-25152](https://cve.now/CVE-2023-25152): Symbolic Link (Symlink) Following in github.com/pterodactyl/wings - Severity: High 8.4 - Published: Feb 8, 2023 - Affected: fixed in 1.7.3; from 1.11.0, fixed in 1.11.3; fixed in 1.7.3; from 1.11.0, fixed in 1.11.3. - Fixed in v1.7.3 (released Feb 8, 2023, the day of disclosure) and v1.11.3 (released Feb 8, 2023, the day of disclosure). - The latest release, v1.13.4, is not affected. ### [CVE-2021-32699](https://cve.now/CVE-2021-32699): Asymmetric Resource Consumption (Amplification) in Docker containers created by Wings - Severity: Medium 6.5 - Published: Jun 22, 2021 - Affected: fixed in 1.4.4. - Fixed in v1.4.4 (released Jun 21, 2021, 1 day before disclosure). - The latest release, v1.13.4, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/go/github.com/pterodactyl/wings Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.