p PatchFirst

PatchFirst · Aktuelle Sicherheitslücken

Sicherheitslücken in github.com/pterodactyl/wings

In den letzten 30 Tagen veröffentlichte Sicherheitslücken für github.com/pterodactyl/wings: 0. Davon im KEV-Katalog: 0.

RSS ↗ JSON ↗
Sicherheitslücken filtern
Filter zurücksetzen

Sicherheitslücken: 3

  1. CVE-2026-54593

    Hoch · CVSS 8.1EPSS 0,68%Korrektur verfügbar

    Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions

    Pterodactyl is a free, open-source game server management panel. Prior to Panel version 1.12.3 and Wings version 1.12.2, the Wings /upload/file endpoint accepted any valid panel-signed JWT that contained server_uuid, user_uuid, and unique_id claims without checking the token's intended purpose; because the Panel issues JWTs carrying those same claims for lower-privilege operations such as WebSocket authentication and file-download links, an authenticated subuser could reuse one of those tokens (for example a WebSocket token obtained with only the websocket.connect permission) by replaying it against /upload/file to write arbitrary files to th

    github.com/pterodactyl/wings
    • Auf 1.12.2 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  2. GHSA-hr7j-63v7-vj7g

    Hoch · CVSS 7.5Korrektur verfügbar

    Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change

    ### Summary Deleting a user account with SFTP access or changing the user's password does not immediately terminate existing SFTP sessions, allowing continued filesystem access after credentials are revoked. This can result in unintended and unauthorized access to server files even after administrators believe access has been fully invalidated. ### Details When a user with SFTP access is deleted from the Pterodactyl Panel or when the user's password is changed while one or more SFTP connections are active, those existing connections remain fully functional. Neither account deletion nor password change invalidates the authentication state o

    github.com/pterodactyl/wings
    • Auf 1.12.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  3. CVE-2025-68954

    Hoch · CVSS 7.5EPSS 0,24%Korrektur verfügbar

    Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced

    Pterodactyl is a free, open-source game server management panel. Versions 1.11.11 and below do not revoke active SFTP connections when a user is removed from a server instance or has their permissions changes with respect to file access over SFTP. This allows a user that was already connected to SFTP to remain connected and access files even after their permissions are revoked. A user must have been connected to SFTP at the time of their permissions being revoked in order for this vulnerability to be exploited. This issue is fixed in version 1.12.0.

    github.com/pterodactyl/wings
    • Auf 1.12.0 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

Prüfen Sie Ihren Server

Gleichen Sie Ihren installierten Stack und seine Versionen mit den aktuellen Sicherheitsmeldungen ab.

Prüfen Sie Ihren Server →