Read the docs
TI-2026-44135 Aliases CVE-2026-61617

Pterodactyl Wings SFTP write path does not enforce disk quota, allowing node-wide disk exhaustion

Priority HIGH 67CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-400.

Summary

Wings is the server control plane for the Pterodactyl game-server management panel. In versions up to and including 1.13.2, the SFTP write path does not enforce a server's disk quota during a transfer, allowing a tenant with SFTP write access to a single server to exhaust the host node's physical disk and take down every server on it. Wings checks available space only once, as a boolean, when the write handle is opened, using a stale cached usage value and without knowing the size of the incoming data, and it then returns a raw, unaccounted file handle that is never re-checked as the transfer proceeds. A single upload can therefore be written without bound, far beyond the configured disk limit, until the node's disk is full, and because a server stopped for exceeding its limit is not treated as suspended, SFTP writes are still accepted even after the quota is already exceeded. This issue is fixed in version 1.13.3.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00436 38th percentileScored 2026-11-07
Fix Fixed wings (pterodactyl): 1.13.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
pterodactylwingsbefore 1.13.31.13.3Patch availableCNA
  • wings Vendorpterodactyl Affected before 1.13.3 Fixed in 1.13.3 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:pterodactyl:wings:*:*:*:*:*:*:*:*——pterodactyl
  • cpe:2.3:a:pterodactyl:wings:*:*:*:*:*:*:*:* Versions — — ·pterodactyl

Remediation

  • Fix · CNA wings (pterodactyl) Fixed in 1.13.3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-61617

References

Other 2

  • TI-2025-31212 Pterodactyl Panel Allows Unauthenticated Arbitrary Remote Code Execution CVSS 3.1CRITICAL 10.0
  • TI-2024-17963 Improper isolation of server file access in github.com/pterodactyl/wings CVSS 3.1CRITICAL 10.0
  • TI-2026-17479 Endless reprocessing/reupload of activity log data due to SQLite max parameters limit not being considered CVSS 4.0HIGH 8.3
  • TI-2026-58966 Pterodactyl Panel before 1.14.1 Privilege Escalation via Schedule Tasks CVSS 4.0HIGH 8.7
  • TI-2026-44131 Resource allocation without limits in pterodactyl panel CVSS 3.1HIGH 7.5
  • TI-2026-39427 Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions CVSS 3.1HIGH 8.1
See all 27 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences