XSS vulnerability when listing users on add & modify server pages.
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from GitHub. Impact type from CWE-79.
Summary
### Impact An XSS vulnerability exists in versions of Pterodactyl Panel before 0.7.19. Affected versions do not properly sanitize account names before rendering them to the dropdown selector in the admin area when creating or modifying a server. ### Patches This XSS has been addressed in 0.7.19 and will be rolled forwards into the 1.0-rc.7 release. ### Workarounds No workaround exists without manual patching. See https://github.com/pterodactyl/panel/pull/2441/files for the files changed. ### For more information If you have any questions or comments about this advisory please reach out on Discord, or by emailing `dane` at `pterodactyl` dot `io`. _Thank you to Sergej for the responsible disclosure of this issue._
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | pterodactyl/panel (Packagist) | before 0.7.19 | 0.7.19 | Patch available | GHSA-5822-pw57-vv37 |
| — | pterodactyl/panel (Packagist) | 1.0.0-rc.0 to before 1.0.0-rc.7 | 1.0.0-rc.7 | Patch available | GHSA-5822-pw57-vv37 |
- pterodactyl/panel (Packagist) Vendor— Affected before 0.7.19 Fixed in 0.7.19 Patch available GHSA-5822-pw57-vv37
- pterodactyl/panel (Packagist) Vendor— Affected 1.0.0-rc.0 to before 1.0.0-rc.7 Fixed in 1.0.0-rc.7 Patch available GHSA-5822-pw57-vv37
Remediation
- Fix · GHSA-5822-pw57-vv37 pterodactyl/panel (Packagist) Fixed in 0.7.19 Advisory →
- Fix · GHSA-5822-pw57-vv37 pterodactyl/panel (Packagist) Fixed in 1.0.0-rc.7 Advisory →
Timeline
- 2026-10-03 Threatist record created from GHSA-5822-pw57-vv37
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences