TI-2023-10630 Aliases CVE-2023-25168 GHSA-66p8-j459-rq63

Symbolic Link (Symlink) Following allowing the deletion of files and directories on the host system in wings

MEDIUM 43CWE-59Published 2023-02-08 · Updated 2025-03-10

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

Wings is Pterodactyl's server control plane. This vulnerability can be used to delete files and directories recursively on the host system. This vulnerability can be combined with `GHSA-p8r3-83r8-jwj5` to overwrite files on the host system. In order to use this exploit, an attacker must have an existing "server" allocated and controlled by Wings. This vulnerability has been resolved in version `v1.11.4` of Wings, and has been back-ported to the 1.7 release series in `v1.7.4`. Anyone running `v1.11.x` should upgrade to `v1.11.4` and anyone running `v1.7.x` should upgrade to `v1.7.4`. There are no known workarounds for this issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00956 61st percentileScored 2026-11-08

Fix Fixed wings (pterodactyl): 1.7.4, 1.11.4github.com/pterodactyl/wings (Go): 1.7.4, 1.11.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
pterodactyl	wings	before 1.7.4; 1.11.0 to before 1.11.4	1.7.4, 1.11.4	Patch available	CNA
—	github.com/pterodactyl/wings (Go)	before 1.7.4	1.7.4	Patch available	GHSA-66p8-j459-rq63
—	github.com/pterodactyl/wings (Go)	1.11.0 to before 1.11.4	1.11.4	Patch available	GHSA-66p8-j459-rq63

wings Vendorpterodactyl Affected before 1.7.4; 1.11.0 to before 1.11.4 Fixed in 1.7.4, 1.11.4 Patch available CNA
github.com/pterodactyl/wings (Go) Vendor— Affected before 1.7.4 Fixed in 1.7.4 Patch available GHSA-66p8-j459-rq63
github.com/pterodactyl/wings (Go) Vendor— Affected 1.11.0 to before 1.11.4 Fixed in 1.11.4 Patch available GHSA-66p8-j459-rq63

CPE configurations NVD · 5

CPE	Versions	Role	Vendor
cpe:2.3:a:pterodactyl:wings::::::::	1.7.0 to before 1.7.4	Vulnerable	pterodactyl
cpe:2.3:a:pterodactyl:wings:1.11.0:-::::::	1.11.0	Vulnerable	pterodactyl
cpe:2.3:a:pterodactyl:wings:1.11.1:::::::*	1.11.1	Vulnerable	pterodactyl
cpe:2.3:a:pterodactyl:wings:1.11.2:::::::*	1.11.2	Vulnerable	pterodactyl
cpe:2.3:a:pterodactyl:wings:1.11.3:::::::*	1.11.3	Vulnerable	pterodactyl

cpe:2.3:a:pterodactyl:wings:*:*:*:*:*:*:*:* Versions 1.7.0 to before 1.7.4 Vulnerable ·pterodactyl
cpe:2.3:a:pterodactyl:wings:1.11.0:-:*:*:*:*:*:* Versions 1.11.0 Vulnerable ·pterodactyl
cpe:2.3:a:pterodactyl:wings:1.11.1:*:*:*:*:*:*:* Versions 1.11.1 Vulnerable ·pterodactyl
cpe:2.3:a:pterodactyl:wings:1.11.2:*:*:*:*:*:*:* Versions 1.11.2 Vulnerable ·pterodactyl
cpe:2.3:a:pterodactyl:wings:1.11.3:*:*:*:*:*:*:* Versions 1.11.3 Vulnerable ·pterodactyl

Remediation

Fix · CNA wings (pterodactyl) Fixed in 1.7.4, 1.11.4
Fix · GHSA-66p8-j459-rq63 github.com/pterodactyl/wings (Go) Fixed in 1.7.4 Advisory →
Fix · GHSA-66p8-j459-rq63 github.com/pterodactyl/wings (Go) Fixed in 1.11.4 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2023-25168
2026-10-03 Alias added: GHSA-66p8-j459-rq63

References

Patch 1

https://github.com/pterodactyl/wings/commit/429ac62dba22997a278bc709df5ac00a5a25d83d

Advisory 3

Other 1

https://github.com/pterodactyl/wings

TI-2024-17963 Improper isolation of server file access in github.com/pterodactyl/wings CVSS 3.1CRITICAL 10.0
TI-2026-17479 Endless reprocessing/reupload of activity log data due to SQLite max parameters limit not being considered CVSS 4.0HIGH 8.3
TI-2023-15384 Wings vulnerable to escape to host from installation container CVSS 3.1CRITICAL 9.1
TI-2024-22524 Arbitrary File Write/Read in Pterodactyl wings CVSS 3.1HIGH 8.5
TI-2023-10614 Symbolic Link (Symlink) Following in github.com/pterodactyl/wings CVSS 3.1HIGH 8.8
TI-2025-42653 Uncontrolled resource consumption in pterodactyl panel CVSS 4.0HIGH 8.3

See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences