TI-2024-22525 Aliases CVE-2024-34067 GHSA-384w-wffr-x63q

Multiple cross site scripting (XSS) vulnerabilities in the admin area of Pterodactyl panel

LOW 28CWE-79Published 2024-05-03 · Updated 2024-08-02

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Pterodactyl is a free, open-source game server management panel built with PHP, React, and Go. Importing a malicious egg or gaining access to wings instance could lead to cross site scripting (XSS) on the panel, which could be used to gain an administrator account on the panel. Specifically, the following things are impacted: Egg Docker images and Egg variables: Name, Environment variable, Default value, Description, Validation rules. Additionally, certain fields would reflect malicious input, but it would require the user knowingly entering such input to have an impact. To iterate, this would require an administrator to perform actions and can't be triggered by a normal panel user. This issue has has been addressed in version 1.11.6 and users are advised to upgrade. No workaround is available other than updating to the latest version of the panel.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00457 39th percentileScored 2026-11-07

Fix Fixed panel (pterodactyl): 1.11.6pterodactyl/panel (Packagist): 1.11.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
pterodactyl	panel	before 1.11.6	1.11.6	Patch available	CNA
—	pterodactyl/panel (Packagist)	before 1.11.6	1.11.6	Patch available	GHSA-384w-wffr-x63q

panel Vendorpterodactyl Affected before 1.11.6 Fixed in 1.11.6 Patch available CNA
pterodactyl/panel (Packagist) Vendor— Affected before 1.11.6 Fixed in 1.11.6 Patch available GHSA-384w-wffr-x63q

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:pterodactyl:panel::::::::	before 1.11.6	Vulnerable	pterodactyl

cpe:2.3:a:pterodactyl:panel:*:*:*:*:*:*:*:* Versions before 1.11.6 Vulnerable ·pterodactyl

Remediation

Fix · CNA panel (pterodactyl) Fixed in 1.11.6
Fix · GHSA-384w-wffr-x63q pterodactyl/panel (Packagist) Fixed in 1.11.6 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2024-34067
2026-10-03 Alias added: GHSA-384w-wffr-x63q

References

Patch 3

Advisory 2

Other 1

https://github.com/pterodactyl/panel

TI-2026-21030 Pterodactyl Panel Allows Cross-Node Server Configuration Disclosure via Remote API Missing Authorization CVSS 4.0CRITICAL 9.2
TI-2021-17968 Authentication bypass in Pterodactyl CVSS 3.1HIGH 8.1
TI-2019-16080 Pterodactyl before 0.7.14 with 2FA allows credential sniffing. CVSS 3.0HIGH 7.5
TI-2025-42410 Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced CVSS 4.0HIGH 7.5
TI-2025-42651 Pterodactyl TOTPs can be reused during validity window CVSS 3.1MEDIUM 6.5
TI-2025-42652 Pterodactyl's improper resource locking allows raced queries to create more resources than alloted CVSS 4.0MEDIUM 6.0

See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences