Read the docs
TI-2026-66949 Aliases GHSA-rhq6-9rgh-v45c

Pterodactyl Wings: Chmod operation can be used to change permissions of files outside of the server container

Priority LOW 38Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
—
Confidentiality · integrity · availability
—
Fix status
Fixed

No CVSS vector from any source. Fix status from GitHub.

Summary

In `wings/internal/ufs/fs_unix.go` (line 92-94), this function is defined and is used to change permissions of files in the server: ```go func (fs *UnixFS) fchmodat(op string, dirfd int, name string, mode FileMode) error { return ensurePathError(unix.Fchmodat(dirfd, name, uint32(mode), 0), op, name) } ``` This call to the unix function `fchmodat(int fd, char* name, mode_t mode, int flags)` does not have the flag `AT_SYMLINK_NOFOLLOW` set, and Wings neither checks or validate if the target file is a symlink. This allows one to change permissions of files or folders outside of the server container by making symlinks to existing files in the host and then chmoding it.

Why it matters now

Fix Fixed github.com/pterodactyl/wings (Go): 1.12.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—github.com/pterodactyl/wings (Go)1.11.9 to before 1.12.21.12.2Patch availableGHSA-rhq6-9rgh-v45c
  • github.com/pterodactyl/wings (Go) Vendor— Affected 1.11.9 to before 1.12.2 Fixed in 1.12.2 Patch available GHSA-rhq6-9rgh-v45c

Remediation

  • Fix · GHSA-rhq6-9rgh-v45c github.com/pterodactyl/wings (Go) Fixed in 1.12.2 Advisory →

Timeline

  1. 2026-10-03 Threatist record created from GHSA-rhq6-9rgh-v45c

References

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences