Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-613.
Summary
Pterodactyl is a free, open-source game server management panel. Versions 1.11.11 and below do not revoke active SFTP connections when a user is removed from a server instance or has their permissions changes with respect to file access over SFTP. This allows a user that was already connected to SFTP to remain connected and access files even after their permissions are revoked. A user must have been connected to SFTP at the time of their permissions being revoked in order for this vulnerability to be exploited. This issue is fixed in version 1.12.0.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| pterodactyl | panel | before 1.12.0 | 1.12.0 | Patch available | CNA |
| — | pterodactyl/panel (Packagist) | before 1.12.0 | 1.12.0 | Patch available | GHSA-8c39-xppg-479c |
| — | github.com/pterodactyl/wings (Go) | before 1.12.0 | 1.12.0 | Patch available | GHSA-8c39-xppg-479c |
- panel Vendorpterodactyl Affected before 1.12.0 Fixed in 1.12.0 Patch available CNA
- pterodactyl/panel (Packagist) Vendor— Affected before 1.12.0 Fixed in 1.12.0 Patch available GHSA-8c39-xppg-479c
- github.com/pterodactyl/wings (Go) Vendor— Affected before 1.12.0 Fixed in 1.12.0 Patch available GHSA-8c39-xppg-479c
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:pterodactyl:panel:*:*:*:*:*:*:*:* | before 1.12.0 | Vulnerable | pterodactyl |
| cpe:2.3:a:pterodactyl:wings:*:*:*:*:*:*:*:* | before 1.12.0 | Vulnerable | pterodactyl |
- cpe:2.3:a:pterodactyl:panel:*:*:*:*:*:*:*:* Versions before 1.12.0 Vulnerable ·pterodactyl
- cpe:2.3:a:pterodactyl:wings:*:*:*:*:*:*:*:* Versions before 1.12.0 Vulnerable ·pterodactyl
Remediation
- Fix · CNA panel (pterodactyl) Fixed in 1.12.0
- Fix · GHSA-8c39-xppg-479c pterodactyl/panel (Packagist) Fixed in 1.12.0 Advisory →
- Fix · GHSA-8c39-xppg-479c github.com/pterodactyl/wings (Go) Fixed in 1.12.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2025-68954
- 2026-10-03 Alias added: GHSA-8c39-xppg-479c
References
Advisory 2
More pterodactyl Panel vulnerabilities
- TI-2026-21030 Pterodactyl Panel Allows Cross-Node Server Configuration Disclosure via Remote API Missing Authorization CVSS 4.0CRITICAL 9.2
- TI-2021-17968 Authentication bypass in Pterodactyl CVSS 3.1HIGH 8.1
- TI-2019-16080 Pterodactyl before 0.7.14 with 2FA allows credential sniffing. CVSS 3.0HIGH 7.5
- TI-2025-42651 Pterodactyl TOTPs can be reused during validity window CVSS 3.1MEDIUM 6.5
- TI-2024-22525 Multiple cross site scripting (XSS) vulnerabilities in the admin area of Pterodactyl panel CVSS 3.1MEDIUM 6.1
- TI-2025-42652 Pterodactyl's improper resource locking allows raced queries to create more resources than alloted CVSS 4.0MEDIUM 6.0
Sources
- CVE-2025-68954 · CVE Program
- CVE-2025-68954 · NVD
- FIRST EPSS
- GHSA-8c39-xppg-479c · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences