Affected by GO-2024-2642
and 6 other vulnerabilities
GO-2024-2642: Pterodactyl Wings vulnerable to improper isolation of server file access in github.com/pterodactyl/wings
GO-2024-2814: Pterodactyl Wings vulnerable to Arbitrary File Write/Read in github.com/pterodactyl/wings
GO-2024-2815: Pterodactyl Wings vulnerable to Server-Side Request Forgery during remote file pull in github.com/pterodactyl/wings
GO-2026-4283: Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced in github.com/pterodactyl/wings
GO-2026-4329: Pterodactyl endlessly reprocesses/reuploads activity log data due to SQLite max parameters limit not being considered in github.com/pterodactyl/wings
GO-2026-4331: Pterodactyl websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks in github.com/pterodactyl/wings
GO-2026-4497: Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change in github.com/pterodactyl/wings
New validates the received data to ensure that all the required fields
have been passed along in the request. This should be manually run before
calling Execute().