What’s Vulnerable › Products

pterodactyl wings vulnerabilities

14 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 7 published in the last 12 months.

Check whether your pterodactyl wings version is affected

Latest pterodactyl wings vulnerabilities

• CVE-2026-61617 — Pterodactyl Wings SFTP write path does not enforce disk quota, allowing node-wide disk exhaustion (CVSS 7.7)
• CVE-2026-52856 — Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service (CVSS 7.5)
• CVE-2026-52855 — Wings exposes node configuration secrets through egg configuration-file templating (CVSS 9.9)
• CVE-2026-52857 — Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM (CVSS 5.5)
• CVE-2026-21696 — Endless reprocessing/reupload of activity log data due to SQLite max parameters limit not being considered (CVSS 6.5)
• CVE-2025-69199 — Pterodactyl Wings's websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks under certain circumstances (CVSS 6.5)
• CVE-2025-68954 — Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced (CVSS 5.4)
• CVE-2024-34068 — Server-side Request Forgery during remote file pull in Pterodactyl wings (CVSS 6.4)
• CVE-2024-34066 — Arbitrary File Write/Read in Pterodactyl wings (CVSS 8.4)
• CVE-2024-27102 — Improper isolation of server file access in github.com/pterodactyl/wings (CVSS 8.5)
• CVE-2023-32080 — Wings vulnerable to escape to host from installation container (CVSS 8.8)
• CVE-2023-25168 — Symbolic Link (Symlink) Following allowing the deletion of files and directories on the host system in wings (CVSS 8.2)
• CVE-2023-25152 — Symbolic Link (Symlink) Following in github.com/pterodactyl/wings (CVSS 8.8)
• CVE-2021-32699 — Asymmetric Resource Consumption (Amplification) in Docker containers created by Wings (CVSS 6.5)