Affected by GO-2026-4283
and 3 other vulnerabilities
GO-2026-4283: Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced in github.com/pterodactyl/wings
GO-2026-4329: Pterodactyl endlessly reprocesses/reuploads activity log data due to SQLite max parameters limit not being considered in github.com/pterodactyl/wings
GO-2026-4331: Pterodactyl websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks in github.com/pterodactyl/wings
GO-2026-4497: Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change in github.com/pterodactyl/wings
Scheduler configures the internal cronjob system for Wings and returns the scheduler
instance to the caller. This should only be called once per application lifecycle, additional
calls will result in an error being returned.