pterodactyl

Records28All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical6CVSS 9.0–10.0

CVSS high12CVSS 7.0–8.9

Exploited now

pterodactyl records in CISA KEV

No pterodactyl vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Wings 10 records HIGH Panel 9 records MEDIUM

Records

28 records

TI-2025-31212 CVE-2025-49132 · GHSA-24wv-6c99-f843

Pterodactyl Panel Allows Unauthenticated Arbitrary Remote Code Execution

HIGH 81

Pterodactyl is a free, open-source game server management panel.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.5446 Published 2025-06-20 Fixed in 1.11.11 CWE-94

TI-2024-17963 CVE-2024-27102 · GHSA-494h-9924-xww9

Improper isolation of server file access in github.com/pterodactyl/wings

HIGH 76

Wings is the server control plane for Pterodactyl Panel.

CVSS 3.1CRITICAL 10.0 Network Low privileges No interaction EPSS 0.00545 Published 2024-03-13 Fixed in 1.11.9 CWE-22

TI-2026-17479 CVE-2026-21696 · GHSA-2497-gp99-2m74

Endless reprocessing/reupload of activity log data due to SQLite max parameters limit not being considered

HIGH 75

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel.

CVSS 4.0HIGH 8.3 Network Low privileges No interaction EPSS 0.00552 Published 2026-01-19 Fixed in 1.12.0 CWE-400

TI-2026-58966 CVE-2026-86177 · GHSA-v29m-2pj3-6rhv

Pterodactyl Panel before 1.14.1 Privilege Escalation via Schedule Tasks

HIGH 73

Pterodactyl Panel before 1.14.1 fails to validate action-specific permissions in scheduled task creation, allowing subusers with only schedule.update permission to execute arbitrary console commands.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00577 Published 2026-09-05 Fixed in 1.14.1 CWE-862

TI-2026-44131 CVE-2026-61609 · GHSA-xvc3-826v-xf47

Resource allocation without limits in pterodactyl panel

HIGH 72

Pterodactyl is a free, open-source game server management panel.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00498 Published 2026-07-28 Fixed in 1.13.0 CWE-770

TI-2026-39427 CVE-2026-54593 · GHSA-8r6w-3qq5-4p4r

Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions

HIGH 70

Pterodactyl is a free, open-source game server management panel.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00681 Published 2026-07-28 Fixed in 1.12.3, 1.12.2 CWE-1259

TI-2026-44135 CVE-2026-61617

Pterodactyl Wings SFTP write path does not enforce disk quota, allowing node-wide disk exhaustion

HIGH 67

Wings is the server control plane for the Pterodactyl game-server management panel.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00436 Published 2026-08-26 Fixed in 1.13.3 CWE-400

TI-2026-37960 CVE-2026-52855 · GHSA-pfvc-3p5h-x7h6

Wings exposes node configuration secrets through egg configuration-file templating

MEDIUM 43

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00506 Published 2026-07-31 Fixed in 1.12.3 CWE-200

TI-2023-15384 CVE-2023-32080 · GHSA-p744-4q6p-hvc2

Wings vulnerable to escape to host from installation container

MEDIUM 43

Wings is the server control plane for Pterodactyl Panel.

CVSS 3.1CRITICAL 9.1 Network Low privileges User interaction EPSS 0.00917 Published 2023-05-10 Fixed in 1.7.5, 1.11.6 CWE-250

TI-2023-10630 CVE-2023-25168 · GHSA-66p8-j459-rq63

Symbolic Link (Symlink) Following allowing the deletion of files and directories on the host system in wings

MEDIUM 43

Wings is Pterodactyl's server control plane.

CVSS 3.1CRITICAL 9.6 Network Low privileges No interaction EPSS 0.00956 Published 2023-02-08 Fixed in 1.7.4, 1.11.4 CWE-59

TI-2026-21030 CVE-2026-26016 · GHSA-g7vw-f8p5-c728

Pterodactyl Panel Allows Cross-Node Server Configuration Disclosure via Remote API Missing Authorization

MEDIUM 42

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.0036 Published 2026-02-19 Fixed in 1.12.1 CWE-283

TI-2026-37961 CVE-2026-52856 · GHSA-ghrq-5wpp-hxx5

Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service

MEDIUM 40

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00609 Published 2026-07-31 Fixed in 1.13.0 CWE-129

TI-2024-22524 CVE-2024-34066 · GHSA-gqmf-jqgv-v8fw

Arbitrary File Write/Read in Pterodactyl wings

MEDIUM 40

Pterodactyl wings is the server control plane for Pterodactyl Panel.

CVSS 3.1HIGH 8.5 Network High privileges User interaction EPSS 0.00544 Published 2024-05-03 Fixed in 1.11.12 CWE-552

TI-2023-10614 CVE-2023-25152 · GHSA-p8r3-83r8-jwj5

Symbolic Link (Symlink) Following in github.com/pterodactyl/wings

LOW 39

Wings is Pterodactyl's server control plane.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00682 Published 2023-02-08 Fixed in 1.7.3, 1.11.3 CWE-59

TI-2021-17968 CVE-2021-41129 · GHSA-5vfx-8w6m-h3v4

Authentication bypass in Pterodactyl

LOW 39

Pterodactyl is an open-source game server management panel built with PHP 7, React, and Go.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.01752 Published 2021-10-06 Fixed in 1.6.2 CWE-502

TI-2025-42653 CVE-2025-69199 · GHSA-8w7m-w749-rx98

Uncontrolled resource consumption in pterodactyl panel

LOW 36

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel.

CVSS 4.0HIGH 8.3 Network Low privileges No interaction EPSS 0.00298 Published 2026-01-19 Fixed in 1.12.0 CWE-400

TI-2019-16080 CVE-2019-1020002 · GHSA-fg52-xjfc-9rh8

Pterodactyl before 0.7.14 with 2FA allows credential sniffing.

LOW 36

Pterodactyl before 0.7.14 with 2FA allows credential sniffing.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.01475 Published 2019-07-29 Fixed in 0.7.14 CWE-203

TI-2025-42410 CVE-2025-68954 · GHSA-8c39-xppg-479c

Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced

LOW 34

Pterodactyl is a free, open-source game server management panel.

CVSS 4.0HIGH 7.5 Network High privileges No interaction EPSS 0.00242 Published 2026-01-06 Fixed in 1.12.0 CWE-613

TI-2025-42651 CVE-2025-69197 · GHSA-rgmp-4873-r683

Pterodactyl TOTPs can be reused during validity window

LOW 29

Pterodactyl is a free, open-source game server management panel.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00356 Published 2026-01-06 Fixed in 1.12.0 CWE-287

TI-2024-22526 CVE-2024-34068 · GHSA-qq22-jj8x-4wwv

Server-side Request Forgery during remote file pull in Pterodactyl wings

LOW 29

Pterodactyl wings is the server control plane for Pterodactyl Panel.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00394 Published 2024-05-03 Fixed in 1.11.12 CWE-284

TI-2024-22525 CVE-2024-34067 · GHSA-384w-wffr-x63q

Multiple cross site scripting (XSS) vulnerabilities in the admin area of Pterodactyl panel

LOW 28

Pterodactyl is a free, open-source game server management panel built with PHP, React, and Go.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00457 Published 2024-05-03 Fixed in 1.11.6 CWE-79

TI-2021-12367 CVE-2021-32699 · GHSA-jj6m-r8jc-2gp7

Asymmetric Resource Consumption (Amplification) in Docker containers created by Wings

LOW 28

Wings is the control plane software for the open source Pterodactyl game management system.

CVSS 3.1MEDIUM 6.5 Local Low privileges No interaction EPSS 0.00265 Published 2021-06-22 Fixed in 1.4.4 CWE-400

TI-2025-42652 CVE-2025-69198 · GHSA-jw2v-cq5x-q68g

Pterodactyl's improper resource locking allows raced queries to create more resources than alloted

LOW 26

Pterodactyl is a free, open-source game server management panel.

CVSS 4.0MEDIUM 6.0 Network Low privileges No interaction EPSS 0.00247 Published 2026-01-19 Fixed in 1.12.0 CWE-400

TI-2026-37962 CVE-2026-52857 · GHSA-q6hh-gp44-4hcm

Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM

LOW 24

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.0016 Published 2026-07-31 Fixed in 1.13.0 CWE-400

TI-2021-18015 CVE-2021-41176 · GHSA-m49f-hcxp-6hm6

logout CSRF in Pterodactyl Panel

LOW 21

Pterodactyl is an open-source game server management panel built with PHP 7, React, and Go.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.0052 Published 2021-10-25 Fixed in 1.6.3 CWE-352

Open these records in search →