pterodactyl wings vulnerabilities

CVEs per yearBy the year they were published

1. 20211
2. 20233
3. 20243
4. 20265

Newest CVEs

• CVE-2026-61617

  Pterodactyl Wings SFTP write path does not enforce disk quota, allowing node-wide disk exhaustion

  pterodactyl · wings

  High7.7
• CVE-2026-52856

  Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service

  pterodactyl · wings

  High7.5
• CVE-2026-52855

  Wings exposes node configuration secrets through egg configuration-file templating

  pterodactyl · wings

  Critical9.9
• CVE-2026-52857

  Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM

  pterodactyl · wings

  Medium5.5
• CVE-2026-21696

  Endless reprocessing/reupload of activity log data due to SQLite max parameters limit not being considered

  pterodactyl · wings

  High8.3
• CVE-2024-34066

  Arbitrary File Write/Read in Pterodactyl wings

  pterodactyl · wings

  High8.5
• CVE-2024-34068

  Server-side Request Forgery during remote file pull in Pterodactyl wings

  pterodactyl · wings

  Medium6.4
• CVE-2024-27102

  Improper isolation of server file access in github.com/pterodactyl/wings

  pterodactyl · wings

  Critical10.0
• CVE-2023-32080

  Wings vulnerable to escape to host from installation container

  pterodactyl · wings

  Critical9.1
• CVE-2023-25168

  Symbolic Link (Symlink) Following allowing the deletion of files and directories on the host system in wings

  pterodactyl · wings

  Critical9.6