Pterodactyl Wings: Chmod operation can be used to change permissions of files outside of the server container
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- —
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from GitHub.
Summary
In `wings/internal/ufs/fs_unix.go` (line 92-94), this function is defined and is used to change permissions of files in the server: ```go func (fs *UnixFS) fchmodat(op string, dirfd int, name string, mode FileMode) error { return ensurePathError(unix.Fchmodat(dirfd, name, uint32(mode), 0), op, name) } ``` This call to the unix function `fchmodat(int fd, char* name, mode_t mode, int flags)` does not have the flag `AT_SYMLINK_NOFOLLOW` set, and Wings neither checks or validate if the target file is a symlink. This allows one to change permissions of files or folders outside of the server container by making symlinks to existing files in the host and then chmoding it.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | github.com/pterodactyl/wings (Go) | 1.11.9 to before 1.12.2 | 1.12.2 | Patch available | GHSA-rhq6-9rgh-v45c |
- github.com/pterodactyl/wings (Go) Vendor— Affected 1.11.9 to before 1.12.2 Fixed in 1.12.2 Patch available GHSA-rhq6-9rgh-v45c
Remediation
- Fix · GHSA-rhq6-9rgh-v45c github.com/pterodactyl/wings (Go) Fixed in 1.12.2 Advisory →
Timeline
- 2026-10-03 Threatist record created from GHSA-rhq6-9rgh-v45c
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences