Affected by GO-2026-4283
and 3 other vulnerabilities
GO-2026-4283: Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced in github.com/pterodactyl/wings
GO-2026-4329: Pterodactyl endlessly reprocesses/reuploads activity log data due to SQLite max parameters limit not being considered in github.com/pterodactyl/wings
GO-2026-4331: Pterodactyl websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks in github.com/pterodactyl/wings
GO-2026-4497: Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change in github.com/pterodactyl/wings