VulnerableCode Package Details - pkg:golang/github.com/pterodactyl/wings@1.12.0

Search for packages

Vulnerability	Summary	Fixed by
This package is not known to be affected by vulnerabilities.

Vulnerability

Summary

Fixed by

This package is not known to be affected by vulnerabilities.

Vulnerability	Summary	Aliases
VCID-6e4h-fxsr-cydc	Pterodactyl websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks ### Summary Websockets within wings lack proper rate limiting and throttling. As a result a malicious user can open a large number of connections and then request data through these sockets, causing an excessive volume of data over the network and overloading the host system memory and cpu. Additionally, there is not a limit applied to the total size of messages being sent or received, allowing a malicious user to open thousands of websocket connections and then send massive volumes of information over the socket, overloading the host network, and causing increased CPU and memory load within Wings.	CVE-2025-69199 GHSA-8w7m-w749-rx98
VCID-8spz-vf88-ffg6	Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced Pterodactyl does not revoke _active_ SFTP connections when a user is removed from a server instance or has their permissions changes with respect to file access over SFTP. This allows a user that was already connected to SFTP to remain connected and access files even after their permissions are revoked.	CVE-2025-68954 GHSA-8c39-xppg-479c
VCID-sdtu-fxxk-vqhq	Pterodactyl endlessly reprocesses/reuploads activity log data due to SQLite max parameters limit not being considered ### Summary Wings does not consider SQLite max parameter limit when processing activity log entries allowing for low privileged user to trigger a condition that floods the panel with activity records ### Details After wings sends activity logs to the panel it deletes the processed activity entries from the wings SQLite database. However, it does not consider the max parameter limit of SQLite, 32766 as of SQLite 3.32.0. If wings attempts to delete more than 32766 entries from the SQLite database in one query, it triggers an error (SQL logic error: too many SQL variables (1)) and does not remove any entries from the database. These entries are then indefinitely re-processed and resent to the panel each time the cron runs. https://github.com/pterodactyl/wings/blob/9ffbcdcdb1163da823cf9959b9602df9f7dcb54a/internal/cron/activity_cron.go#L81 https://github.com/pterodactyl/wings/blob/9ffbcdcdb1163da823cf9959b9602df9f7dcb54a/internal/cron/sftp_cron.go#L86 ### PoC Any method that can create the required 32767+ activity entries can trigger this vulnerability. It can (and has) been triggered by normal (non-malicious) use. I attached a simple PoC I used while verifying this that uses sftp to quickly create many small files, thus creating activity entries in the SQLite database. https://ptero.co/mococesoca.go ### Impact By successfully exploiting this vulnerability you can trigger a situation where wings will keep uploading the same activity data to the panel repeatedly (growing each time to include new activity) until the panels’ database server runs out of disk space.	CVE-2026-21696 GHSA-2497-gp99-2m74

Vulnerability

Summary

Aliases

VCID-6e4h-fxsr-cydc

Pterodactyl websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks ### Summary Websockets within wings lack proper rate limiting and throttling. As a result a malicious user can open a large number of connections and then request data through these sockets, causing an excessive volume of data over the network and overloading the host system memory and cpu. Additionally, there is not a limit applied to the total size of messages being sent or received, allowing a malicious user to open thousands of websocket connections and then send massive volumes of information over the socket, overloading the host network, and causing increased CPU and memory load within Wings.

CVE-2025-69199
GHSA-8w7m-w749-rx98

VCID-8spz-vf88-ffg6

Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced Pterodactyl does not revoke _active_ SFTP connections when a user is removed from a server instance or has their permissions changes with respect to file access over SFTP. This allows a user that was already connected to SFTP to remain connected and access files even after their permissions are revoked.

CVE-2025-68954
GHSA-8c39-xppg-479c

VCID-sdtu-fxxk-vqhq

Pterodactyl endlessly reprocesses/reuploads activity log data due to SQLite max parameters limit not being considered ### Summary Wings does not consider SQLite max parameter limit when processing activity log entries allowing for low privileged user to trigger a condition that floods the panel with activity records ### Details After wings sends activity logs to the panel it deletes the processed activity entries from the wings SQLite database. However, it does not consider the max parameter limit of SQLite, 32766 as of SQLite 3.32.0. If wings attempts to delete more than 32766 entries from the SQLite database in one query, it triggers an error (SQL logic error: too many SQL variables (1)) and does not remove any entries from the database. These entries are then indefinitely re-processed and resent to the panel each time the cron runs. https://github.com/pterodactyl/wings/blob/9ffbcdcdb1163da823cf9959b9602df9f7dcb54a/internal/cron/activity_cron.go#L81 https://github.com/pterodactyl/wings/blob/9ffbcdcdb1163da823cf9959b9602df9f7dcb54a/internal/cron/sftp_cron.go#L86 ### PoC Any method that can create the required 32767+ activity entries can trigger this vulnerability. It can (and has) been triggered by normal (non-malicious) use. I attached a simple PoC I used while verifying this that uses sftp to quickly create many small files, thus creating activity entries in the SQLite database. https://ptero.co/mococesoca.go ### Impact By successfully exploiting this vulnerability you can trigger a situation where wings will keep uploading the same activity data to the panel repeatedly (growing each time to include new activity) until the panels’ database server runs out of disk space.

CVE-2026-21696
GHSA-2497-gp99-2m74

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-06-04T16:54:36.060723+00:00	GithubOSV Importer	Fixing	VCID-6e4h-fxsr-cydc	https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-8w7m-w749-rx98/GHSA-8w7m-w749-rx98.json	38.6.0
2026-06-04T16:54:21.913922+00:00	GithubOSV Importer	Fixing	VCID-sdtu-fxxk-vqhq	https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-2497-gp99-2m74/GHSA-2497-gp99-2m74.json	38.6.0
2026-06-04T16:54:16.552634+00:00	GithubOSV Importer	Fixing	VCID-8spz-vf88-ffg6	https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-8c39-xppg-479c/GHSA-8c39-xppg-479c.json	38.6.0