TI-2024-17963 Aliases CVE-2024-27102 GHSA-494h-9924-xww9

Improper isolation of server file access in github.com/pterodactyl/wings

HIGH 76CWE-22Published 2024-03-13 · Updated 2025-04-15

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

Wings is the server control plane for Pterodactyl Panel. This vulnerability impacts anyone running the affected versions of Wings. The vulnerability can potentially be used to access files and directories on the host system. The full scope of impact is exactly unknown, but reading files outside of a server's base directory (sandbox root) is possible. In order to use this exploit, an attacker must have an existing "server" allocated and controlled by Wings. Details on the exploitation of this vulnerability are embargoed until March 27th, 2024 at 18:00 UTC. In order to mitigate this vulnerability, a full rewrite of the entire server filesystem was necessary. Because of this, the size of the patch is massive, however effort was made to reduce the amount of breaking changes. Users are advised to update to version 1.11.9. There are no known workarounds for this vulnerability.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00545 45th percentileScored 2026-11-07

Fix Fixed wings (pterodactyl): 1.11.9github.com/pterodactyl/wings (Go): 1.11.9

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
pterodactyl	wings	before 1.11.9	1.11.9	Patch available	CNA
—	github.com/pterodactyl/wings (Go)	before 1.11.9	1.11.9	Patch available	GHSA-494h-9924-xww9

wings Vendorpterodactyl Affected before 1.11.9 Fixed in 1.11.9 Patch available CNA
github.com/pterodactyl/wings (Go) Vendor— Affected before 1.11.9 Fixed in 1.11.9 Patch available GHSA-494h-9924-xww9

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:pterodactyl:wings::::::::	before 1.11.9	Vulnerable	pterodactyl

cpe:2.3:a:pterodactyl:wings:*:*:*:*:*:*:*:* Versions before 1.11.9 Vulnerable ·pterodactyl

Remediation

Fix · CNA wings (pterodactyl) Fixed in 1.11.9
Fix · GHSA-494h-9924-xww9 github.com/pterodactyl/wings (Go) Fixed in 1.11.9 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2024-27102
2026-10-03 Alias added: GHSA-494h-9924-xww9

References

Patch 1

https://github.com/pterodactyl/wings/commit/d1c0ca526007113a0f74f56eba99511b4e989287

Advisory 2

Other 1

https://github.com/pterodactyl/wings

TI-2026-17479 Endless reprocessing/reupload of activity log data due to SQLite max parameters limit not being considered CVSS 4.0HIGH 8.3
TI-2023-15384 Wings vulnerable to escape to host from installation container CVSS 3.1CRITICAL 9.1
TI-2023-10630 Symbolic Link (Symlink) Following allowing the deletion of files and directories on the host system in wings CVSS 3.1CRITICAL 9.6
TI-2024-22524 Arbitrary File Write/Read in Pterodactyl wings CVSS 3.1HIGH 8.5
TI-2023-10614 Symbolic Link (Symlink) Following in github.com/pterodactyl/wings CVSS 3.1HIGH 8.8
TI-2025-42653 Uncontrolled resource consumption in pterodactyl panel CVSS 4.0HIGH 8.3

See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences