Affected by GO-2026-4283
and 8 other vulnerabilities
GO-2026-4283: Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced in github.com/pterodactyl/wings
GO-2026-4329: Pterodactyl endlessly reprocesses/reuploads activity log data due to SQLite max parameters limit not being considered in github.com/pterodactyl/wings
GO-2026-4331: Pterodactyl websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks in github.com/pterodactyl/wings
GO-2026-4497: Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change in github.com/pterodactyl/wings
GO-2026-5814: Pterodactyl Wings: Chmod operation can be used to change permissions of files outside of the server container in github.com/pterodactyl/wings
GO-2026-6120: Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions in github.com/pterodactyl/wings
GO-2026-6156: Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service in github.com/pterodactyl/wings
GO-2026-6158: Wings exposes node configuration secrets through egg configuration-file templating in github.com/pterodactyl/wings
GO-2026-6159: Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM in github.com/pterodactyl/wings
New validates the received data to ensure that all the required fields
have been passed along in the request. This should be manually run before
calling Execute().