wings
- Software type
- System management
- Total vulnerabilities (90 days)
- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
As of 11/08/2026, wings recorded 1 security vulnerability in the last 90 days, of which 1 is rated High or Critical. None of these vulnerabilities is actively exploited (KEV) according to CISA's catalog. CyStack recommends that organizations and individual users apply patches as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of wings and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-61617Pterodactyl Wings SFTP write path does not enforce disk quota, allowing node-wide disk exhaustionCVE-2026-52857Wings: Maliciously or erroneously created parsed config files can cause wings process to OOMCVE-2026-52856Wings: Maliciously crafted packet during SFTP connection handshake causes denial of serviceCVE-2026-52855Wings exposes node configuration secrets through egg configuration-file templatingCVE-2026-21696Endless reprocessing/reupload of activity log data due to SQLite max parameters limit not being considered| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-61617Pterodactyl Wings SFTP write path does not enforce disk quota, allowing node-wide disk exhaustion | Exploitation statusActively exploited | FixYes |
| SeverityHigh |
CVE-2026-52857Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM | Exploitation statusNot exploited | FixYes | Published07/31/2026 | SeverityMedium |
|---|
CVE-2026-52856Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service | Exploitation statusNot exploited | FixYes | Published07/31/2026 | SeverityHigh |
|---|
CVE-2026-52855Wings exposes node configuration secrets through egg configuration-file templating | Exploitation statusNot exploited | FixYes | Published07/31/2026 | SeverityCritical |
|---|
CVE-2026-21696Endless reprocessing/reupload of activity log data due to SQLite max parameters limit not being considered | Exploitation statusActively exploited | FixNo | Published01/19/2026 | SeverityHigh |
|---|
CVE-2024-34068Server-side Request Forgery during remote file pull in Pterodactyl wings | Exploitation statusNot exploited | FixNo | Published05/03/2024 | SeverityMedium |
|---|
CVE-2024-34066Arbitrary File Write/Read in Pterodactyl wings | Exploitation statusNot exploited | FixNo | Published05/03/2024 | SeverityHigh |
|---|
CVE-2024-27102Improper isolation of server file access in github.com/pterodactyl/wings | Exploitation statusActively exploited | FixNo | Published03/13/2024 | SeverityCritical |
|---|
CVE-2023-32080Wings vulnerable to escape to host from installation container | Exploitation statusNot exploited | FixYes | Published05/10/2023 | SeverityCritical |
|---|
CVE-2023-25168Symbolic Link (Symlink) Following allowing the deletion of files and directories on the host system in wings | Exploitation statusNot exploited | FixYes | Published02/08/2023 | SeverityCritical |
|---|
CVE-2023-25152Symbolic Link (Symlink) Following in github.com/pterodactyl/wings | Exploitation statusNot exploited | FixYes | Published02/08/2023 | SeverityHigh |
|---|
CVE-2021-32699Asymmetric Resource Consumption (Amplification) in Docker containers created by Wings | Exploitation statusNot confirmed | FixNo | Published06/22/2021 | SeverityMedium |
|---|
12 Results | Page 1 of 1