Symbolic Link (Symlink) Following in github.com/pterodactyl/wings
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.
Summary
Wings is Pterodactyl's server control plane. Affected versions are subject to a vulnerability which can be used to create new files and directory structures on the host system that previously did not exist, potentially allowing attackers to change their resource allocations, promote their containers to privileged mode, or potentially add ssh authorized keys to allow the attacker access to a remote shell on the target machine. In order to use this exploit, an attacker must have an existing "server" allocated and controlled by the Wings Daemon. This vulnerability has been resolved in version `v1.11.3` of the Wings Daemon, and has been back-ported to the 1.7 release series in `v1.7.3`. Anyone running `v1.11.x` should upgrade to `v1.11.3` and anyone running `v1.7.x` should upgrade to `v1.7.3`. There are no known workarounds for this vulnerability. ### Workarounds None at this time.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| pterodactyl | wings | before 1.7.3; 1.11.0 to before 1.11.3 | 1.7.3, 1.11.3 | Patch available | CNA |
| — | github.com/pterodactyl/wings (Go) | before 1.7.3 | 1.7.3 | Patch available | GHSA-p8r3-83r8-jwj5 |
| — | github.com/pterodactyl/wings (Go) | 1.11.0 to before 1.11.3 | 1.11.3 | Patch available | GHSA-p8r3-83r8-jwj5 |
- wings Vendorpterodactyl Affected before 1.7.3; 1.11.0 to before 1.11.3 Fixed in 1.7.3, 1.11.3 Patch available CNA
- github.com/pterodactyl/wings (Go) Vendor— Affected before 1.7.3 Fixed in 1.7.3 Patch available GHSA-p8r3-83r8-jwj5
- github.com/pterodactyl/wings (Go) Vendor— Affected 1.11.0 to before 1.11.3 Fixed in 1.11.3 Patch available GHSA-p8r3-83r8-jwj5
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:pterodactyl:wings:*:*:*:*:*:*:*:* | before 1.7.3 | Vulnerable | pterodactyl |
| cpe:2.3:a:pterodactyl:wings:1.11.0:-:*:*:*:*:*:* | 1.11.0 | Vulnerable | pterodactyl |
| cpe:2.3:a:pterodactyl:wings:1.11.1:*:*:*:*:*:*:* | 1.11.1 | Vulnerable | pterodactyl |
| cpe:2.3:a:pterodactyl:wings:1.11.2:*:*:*:*:*:*:* | 1.11.2 | Vulnerable | pterodactyl |
- cpe:2.3:a:pterodactyl:wings:*:*:*:*:*:*:*:* Versions before 1.7.3 Vulnerable ·pterodactyl
- cpe:2.3:a:pterodactyl:wings:1.11.0:-:*:*:*:*:*:* Versions 1.11.0 Vulnerable ·pterodactyl
- cpe:2.3:a:pterodactyl:wings:1.11.1:*:*:*:*:*:*:* Versions 1.11.1 Vulnerable ·pterodactyl
- cpe:2.3:a:pterodactyl:wings:1.11.2:*:*:*:*:*:*:* Versions 1.11.2 Vulnerable ·pterodactyl
Remediation
- Fix · CNA wings (pterodactyl) Fixed in 1.7.3, 1.11.3
- Fix · GHSA-p8r3-83r8-jwj5 github.com/pterodactyl/wings (Go) Fixed in 1.7.3 Advisory →
- Fix · GHSA-p8r3-83r8-jwj5 github.com/pterodactyl/wings (Go) Fixed in 1.11.3 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2023-25152
- 2026-10-03 Alias added: GHSA-p8r3-83r8-jwj5
References
Advisory 2
More pterodactyl Wings vulnerabilities
- TI-2024-17963 Improper isolation of server file access in github.com/pterodactyl/wings CVSS 3.1CRITICAL 10.0
- TI-2026-17479 Endless reprocessing/reupload of activity log data due to SQLite max parameters limit not being considered CVSS 4.0HIGH 8.3
- TI-2023-15384 Wings vulnerable to escape to host from installation container CVSS 3.1CRITICAL 9.1
- TI-2023-10630 Symbolic Link (Symlink) Following allowing the deletion of files and directories on the host system in wings CVSS 3.1CRITICAL 9.6
- TI-2024-22524 Arbitrary File Write/Read in Pterodactyl wings CVSS 3.1HIGH 8.5
- TI-2025-42653 Uncontrolled resource consumption in pterodactyl panel CVSS 4.0HIGH 8.3
Sources
- CVE-2023-25152 · CVE Program
- CVE-2023-25152 · NVD
- FIRST EPSS
- GHSA-p8r3-83r8-jwj5 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences