server

Oct 14, 2026

Changes in this version

type Manager

+ func (m *Manager) AddIfMissing(s *Server) bool

type Server

+ func (s *Server) StartTransferring() bool

type WebsocketBag

+ func (w *WebsocketBag) CancelUser(user string)

+ func (w *WebsocketBag) TryPush(u uuid.UUID, cancel *context.CancelFunc, user func() string, max int) bool

Jun 28, 2026

Changes in this version

type Server

+ func (s *Server) IsInProtectedState() bool

+ func (s *Server) SetInstalling(state bool)

May 29, 2026 GO-2026-6156 +1 more

  GO-2026-6156: Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service in github.com/pterodactyl/wings

  GO-2026-6159: Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM in github.com/pterodactyl/wings

May 23, 2026 GO-2026-6156 +2 more

  GO-2026-6156: Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service in github.com/pterodactyl/wings

  GO-2026-6158: Wings exposes node configuration secrets through egg configuration-file templating in github.com/pterodactyl/wings

  GO-2026-6159: Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM in github.com/pterodactyl/wings

Jan 13, 2026 GO-2026-5814 +4 more

  GO-2026-5814: Pterodactyl Wings: Chmod operation can be used to change permissions of files outside of the server container in github.com/pterodactyl/wings

  GO-2026-6120: Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions in github.com/pterodactyl/wings

  GO-2026-6156: Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service in github.com/pterodactyl/wings

  GO-2026-6158: Wings exposes node configuration secrets through egg configuration-file templating in github.com/pterodactyl/wings

  GO-2026-6159: Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM in github.com/pterodactyl/wings

Jan 6, 2026 GO-2026-4497 +5 more

  GO-2026-4497: Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change in github.com/pterodactyl/wings

  GO-2026-5814: Pterodactyl Wings: Chmod operation can be used to change permissions of files outside of the server container in github.com/pterodactyl/wings

  GO-2026-6120: Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions in github.com/pterodactyl/wings

  GO-2026-6156: Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service in github.com/pterodactyl/wings

  GO-2026-6158: Wings exposes node configuration secrets through egg configuration-file templating in github.com/pterodactyl/wings

  GO-2026-6159: Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM in github.com/pterodactyl/wings

Changes in this version

type Server

+ func (s *Server) Sftp() *system.ContextBag

type WebsocketBag

+ func (w *WebsocketBag) Len() int

May 8, 2024 GO-2026-4283 +8 more

  GO-2026-4283: Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced in github.com/pterodactyl/wings

  GO-2026-4329: Pterodactyl endlessly reprocesses/reuploads activity log data due to SQLite max parameters limit not being considered in github.com/pterodactyl/wings

  GO-2026-4331: Pterodactyl websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks in github.com/pterodactyl/wings

  GO-2026-4497: Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change in github.com/pterodactyl/wings

  GO-2026-5814: Pterodactyl Wings: Chmod operation can be used to change permissions of files outside of the server container in github.com/pterodactyl/wings

  GO-2026-6120: Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions in github.com/pterodactyl/wings

  GO-2026-6156: Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service in github.com/pterodactyl/wings

  GO-2026-6158: Wings exposes node configuration secrets through egg configuration-file templating in github.com/pterodactyl/wings

  GO-2026-6159: Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM in github.com/pterodactyl/wings

May 3, 2024 GO-2026-4283 +8 more

  GO-2026-4283: Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced in github.com/pterodactyl/wings

  GO-2026-4329: Pterodactyl endlessly reprocesses/reuploads activity log data due to SQLite max parameters limit not being considered in github.com/pterodactyl/wings

  GO-2026-4331: Pterodactyl websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks in github.com/pterodactyl/wings

  GO-2026-4497: Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change in github.com/pterodactyl/wings

  GO-2026-5814: Pterodactyl Wings: Chmod operation can be used to change permissions of files outside of the server container in github.com/pterodactyl/wings

  GO-2026-6120: Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions in github.com/pterodactyl/wings

  GO-2026-6156: Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service in github.com/pterodactyl/wings

  GO-2026-6158: Wings exposes node configuration secrets through egg configuration-file templating in github.com/pterodactyl/wings

  GO-2026-6159: Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM in github.com/pterodactyl/wings

Mar 14, 2024 GO-2024-2814 +10 more

  GO-2024-2814: Pterodactyl Wings vulnerable to Arbitrary File Write/Read in github.com/pterodactyl/wings

  GO-2024-2815: Pterodactyl Wings vulnerable to Server-Side Request Forgery during remote file pull in github.com/pterodactyl/wings

  GO-2026-4283: Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced in github.com/pterodactyl/wings

  GO-2026-4329: Pterodactyl endlessly reprocesses/reuploads activity log data due to SQLite max parameters limit not being considered in github.com/pterodactyl/wings

  GO-2026-4331: Pterodactyl websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks in github.com/pterodactyl/wings

  GO-2026-4497: Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change in github.com/pterodactyl/wings

  GO-2026-5814: Pterodactyl Wings: Chmod operation can be used to change permissions of files outside of the server container in github.com/pterodactyl/wings

  GO-2026-6120: Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions in github.com/pterodactyl/wings

  GO-2026-6156: Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service in github.com/pterodactyl/wings

  GO-2026-6158: Wings exposes node configuration secrets through egg configuration-file templating in github.com/pterodactyl/wings

  GO-2026-6159: Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM in github.com/pterodactyl/wings

Mar 13, 2024 GO-2024-2814 +10 more

  GO-2024-2814: Pterodactyl Wings vulnerable to Arbitrary File Write/Read in github.com/pterodactyl/wings

  GO-2024-2815: Pterodactyl Wings vulnerable to Server-Side Request Forgery during remote file pull in github.com/pterodactyl/wings

  GO-2026-4283: Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced in github.com/pterodactyl/wings

  GO-2026-4329: Pterodactyl endlessly reprocesses/reuploads activity log data due to SQLite max parameters limit not being considered in github.com/pterodactyl/wings

  GO-2026-4331: Pterodactyl websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks in github.com/pterodactyl/wings

  GO-2026-4497: Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change in github.com/pterodactyl/wings

  GO-2026-5814: Pterodactyl Wings: Chmod operation can be used to change permissions of files outside of the server container in github.com/pterodactyl/wings

  GO-2026-6120: Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions in github.com/pterodactyl/wings

  GO-2026-6156: Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service in github.com/pterodactyl/wings

  GO-2026-6158: Wings exposes node configuration secrets through egg configuration-file templating in github.com/pterodactyl/wings

  GO-2026-6159: Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM in github.com/pterodactyl/wings

Mar 13, 2024 GO-2024-2814 +10 more

  GO-2024-2814: Pterodactyl Wings vulnerable to Arbitrary File Write/Read in github.com/pterodactyl/wings

  GO-2024-2815: Pterodactyl Wings vulnerable to Server-Side Request Forgery during remote file pull in github.com/pterodactyl/wings

  GO-2026-4283: Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced in github.com/pterodactyl/wings

  GO-2026-4329: Pterodactyl endlessly reprocesses/reuploads activity log data due to SQLite max parameters limit not being considered in github.com/pterodactyl/wings

  GO-2026-4331: Pterodactyl websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks in github.com/pterodactyl/wings

  GO-2026-4497: Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change in github.com/pterodactyl/wings

  GO-2026-5814: Pterodactyl Wings: Chmod operation can be used to change permissions of files outside of the server container in github.com/pterodactyl/wings

  GO-2026-6120: Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions in github.com/pterodactyl/wings

  GO-2026-6156: Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service in github.com/pterodactyl/wings

  GO-2026-6158: Wings exposes node configuration secrets through egg configuration-file templating in github.com/pterodactyl/wings

  GO-2026-6159: Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM in github.com/pterodactyl/wings

Oct 10, 2023 GO-2024-2642 +10 more

  GO-2024-2642: Pterodactyl Wings vulnerable to improper isolation of server file access in github.com/pterodactyl/wings

  GO-2024-2814: Pterodactyl Wings vulnerable to Arbitrary File Write/Read in github.com/pterodactyl/wings

  GO-2024-2815: Pterodactyl Wings vulnerable to Server-Side Request Forgery during remote file pull in github.com/pterodactyl/wings

  GO-2026-4283: Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced in github.com/pterodactyl/wings

  GO-2026-4329: Pterodactyl endlessly reprocesses/reuploads activity log data due to SQLite max parameters limit not being considered in github.com/pterodactyl/wings

  GO-2026-4331: Pterodactyl websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks in github.com/pterodactyl/wings

  GO-2026-4497: Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change in github.com/pterodactyl/wings

  GO-2026-6120: Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions in github.com/pterodactyl/wings

  GO-2026-6156: Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service in github.com/pterodactyl/wings

  GO-2026-6158: Wings exposes node configuration secrets through egg configuration-file templating in github.com/pterodactyl/wings

  GO-2026-6159: Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM in github.com/pterodactyl/wings

Jul 25, 2023 GO-2024-2642 +10 more

  GO-2024-2642: Pterodactyl Wings vulnerable to improper isolation of server file access in github.com/pterodactyl/wings

  GO-2024-2814: Pterodactyl Wings vulnerable to Arbitrary File Write/Read in github.com/pterodactyl/wings

  GO-2024-2815: Pterodactyl Wings vulnerable to Server-Side Request Forgery during remote file pull in github.com/pterodactyl/wings

  GO-2026-4283: Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced in github.com/pterodactyl/wings

  GO-2026-4329: Pterodactyl endlessly reprocesses/reuploads activity log data due to SQLite max parameters limit not being considered in github.com/pterodactyl/wings

  GO-2026-4331: Pterodactyl websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks in github.com/pterodactyl/wings

  GO-2026-4497: Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change in github.com/pterodactyl/wings

  GO-2026-6120: Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions in github.com/pterodactyl/wings

  GO-2026-6156: Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service in github.com/pterodactyl/wings

  GO-2026-6158: Wings exposes node configuration secrets through egg configuration-file templating in github.com/pterodactyl/wings

  GO-2026-6159: Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM in github.com/pterodactyl/wings

May 10, 2023 GO-2024-2642 +10 more

  GO-2024-2642: Pterodactyl Wings vulnerable to improper isolation of server file access in github.com/pterodactyl/wings

  GO-2024-2814: Pterodactyl Wings vulnerable to Arbitrary File Write/Read in github.com/pterodactyl/wings

  GO-2024-2815: Pterodactyl Wings vulnerable to Server-Side Request Forgery during remote file pull in github.com/pterodactyl/wings

  GO-2026-4283: Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced in github.com/pterodactyl/wings

  GO-2026-4329: Pterodactyl endlessly reprocesses/reuploads activity log data due to SQLite max parameters limit not being considered in github.com/pterodactyl/wings

  GO-2026-4331: Pterodactyl websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks in github.com/pterodactyl/wings

  GO-2026-4497: Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change in github.com/pterodactyl/wings

  GO-2026-6120: Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions in github.com/pterodactyl/wings

  GO-2026-6156: Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service in github.com/pterodactyl/wings

  GO-2026-6158: Wings exposes node configuration secrets through egg configuration-file templating in github.com/pterodactyl/wings

  GO-2026-6159: Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM in github.com/pterodactyl/wings

Mar 7, 2023 GO-2023-1768 +11 more

  GO-2023-1768: Wings vulnerable to escape to host from installation container in github.com/pterodactyl/wings

  GO-2024-2642: Pterodactyl Wings vulnerable to improper isolation of server file access in github.com/pterodactyl/wings

  GO-2024-2814: Pterodactyl Wings vulnerable to Arbitrary File Write/Read in github.com/pterodactyl/wings

  GO-2024-2815: Pterodactyl Wings vulnerable to Server-Side Request Forgery during remote file pull in github.com/pterodactyl/wings

  GO-2026-4283: Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced in github.com/pterodactyl/wings

  GO-2026-4329: Pterodactyl endlessly reprocesses/reuploads activity log data due to SQLite max parameters limit not being considered in github.com/pterodactyl/wings

  GO-2026-4331: Pterodactyl websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks in github.com/pterodactyl/wings

  GO-2026-4497: Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change in github.com/pterodactyl/wings

  GO-2026-6120: Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions in github.com/pterodactyl/wings

  GO-2026-6156: Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service in github.com/pterodactyl/wings

  GO-2026-6158: Wings exposes node configuration secrets through egg configuration-file templating in github.com/pterodactyl/wings

  GO-2026-6159: Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM in github.com/pterodactyl/wings

Feb 8, 2023 GO-2023-1768 +11 more

  GO-2023-1768: Wings vulnerable to escape to host from installation container in github.com/pterodactyl/wings

  GO-2024-2642: Pterodactyl Wings vulnerable to improper isolation of server file access in github.com/pterodactyl/wings

  GO-2024-2814: Pterodactyl Wings vulnerable to Arbitrary File Write/Read in github.com/pterodactyl/wings

  GO-2024-2815: Pterodactyl Wings vulnerable to Server-Side Request Forgery during remote file pull in github.com/pterodactyl/wings

  GO-2026-4283: Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced in github.com/pterodactyl/wings

  GO-2026-4329: Pterodactyl endlessly reprocesses/reuploads activity log data due to SQLite max parameters limit not being considered in github.com/pterodactyl/wings

  GO-2026-4331: Pterodactyl websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks in github.com/pterodactyl/wings

  GO-2026-4497: Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change in github.com/pterodactyl/wings

  GO-2026-6120: Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions in github.com/pterodactyl/wings

  GO-2026-6156: Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service in github.com/pterodactyl/wings

  GO-2026-6158: Wings exposes node configuration secrets through egg configuration-file templating in github.com/pterodactyl/wings

  GO-2026-6159: Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM in github.com/pterodactyl/wings

Feb 8, 2023 GO-2023-1555 +12 more

  GO-2023-1555: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following resulting in deletion of files and directories on the host system in github.com/pterodactyl/wings

  GO-2023-1768: Wings vulnerable to escape to host from installation container in github.com/pterodactyl/wings

  GO-2024-2642: Pterodactyl Wings vulnerable to improper isolation of server file access in github.com/pterodactyl/wings

  GO-2024-2814: Pterodactyl Wings vulnerable to Arbitrary File Write/Read in github.com/pterodactyl/wings

  GO-2024-2815: Pterodactyl Wings vulnerable to Server-Side Request Forgery during remote file pull in github.com/pterodactyl/wings

  GO-2026-4283: Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced in github.com/pterodactyl/wings

  GO-2026-4329: Pterodactyl endlessly reprocesses/reuploads activity log data due to SQLite max parameters limit not being considered in github.com/pterodactyl/wings

  GO-2026-4331: Pterodactyl websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks in github.com/pterodactyl/wings

  GO-2026-4497: Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change in github.com/pterodactyl/wings

  GO-2026-6120: Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions in github.com/pterodactyl/wings

  GO-2026-6156: Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service in github.com/pterodactyl/wings

  GO-2026-6158: Wings exposes node configuration secrets through egg configuration-file templating in github.com/pterodactyl/wings

  GO-2026-6159: Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM in github.com/pterodactyl/wings

Jan 31, 2023 GO-2023-1542 +13 more

  GO-2023-1542: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following in github.com/pterodactyl/wings

  GO-2023-1555: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following resulting in deletion of files and directories on the host system in github.com/pterodactyl/wings

  GO-2023-1768: Wings vulnerable to escape to host from installation container in github.com/pterodactyl/wings

  GO-2024-2642: Pterodactyl Wings vulnerable to improper isolation of server file access in github.com/pterodactyl/wings

  GO-2024-2814: Pterodactyl Wings vulnerable to Arbitrary File Write/Read in github.com/pterodactyl/wings

  GO-2024-2815: Pterodactyl Wings vulnerable to Server-Side Request Forgery during remote file pull in github.com/pterodactyl/wings

  GO-2026-4283: Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced in github.com/pterodactyl/wings

  GO-2026-4329: Pterodactyl endlessly reprocesses/reuploads activity log data due to SQLite max parameters limit not being considered in github.com/pterodactyl/wings

  GO-2026-4331: Pterodactyl websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks in github.com/pterodactyl/wings

  GO-2026-4497: Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change in github.com/pterodactyl/wings

  GO-2026-6120: Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions in github.com/pterodactyl/wings

  GO-2026-6156: Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service in github.com/pterodactyl/wings

  GO-2026-6158: Wings exposes node configuration secrets through egg configuration-file templating in github.com/pterodactyl/wings

  GO-2026-6159: Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM in github.com/pterodactyl/wings

Jan 27, 2023 GO-2023-1542 +13 more

  GO-2023-1542: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following in github.com/pterodactyl/wings

  GO-2023-1555: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following resulting in deletion of files and directories on the host system in github.com/pterodactyl/wings

  GO-2023-1768: Wings vulnerable to escape to host from installation container in github.com/pterodactyl/wings

  GO-2024-2642: Pterodactyl Wings vulnerable to improper isolation of server file access in github.com/pterodactyl/wings

  GO-2024-2814: Pterodactyl Wings vulnerable to Arbitrary File Write/Read in github.com/pterodactyl/wings

  GO-2024-2815: Pterodactyl Wings vulnerable to Server-Side Request Forgery during remote file pull in github.com/pterodactyl/wings

  GO-2026-4283: Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced in github.com/pterodactyl/wings

  GO-2026-4329: Pterodactyl endlessly reprocesses/reuploads activity log data due to SQLite max parameters limit not being considered in github.com/pterodactyl/wings

  GO-2026-4331: Pterodactyl websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks in github.com/pterodactyl/wings

  GO-2026-4497: Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change in github.com/pterodactyl/wings

  GO-2026-6120: Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions in github.com/pterodactyl/wings

  GO-2026-6156: Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service in github.com/pterodactyl/wings

  GO-2026-6158: Wings exposes node configuration secrets through egg configuration-file templating in github.com/pterodactyl/wings

  GO-2026-6159: Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM in github.com/pterodactyl/wings

Dec 5, 2022 GO-2023-1542 +13 more

  GO-2023-1542: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following in github.com/pterodactyl/wings

  GO-2023-1555: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following resulting in deletion of files and directories on the host system in github.com/pterodactyl/wings

  GO-2023-1768: Wings vulnerable to escape to host from installation container in github.com/pterodactyl/wings

  GO-2024-2642: Pterodactyl Wings vulnerable to improper isolation of server file access in github.com/pterodactyl/wings

  GO-2024-2814: Pterodactyl Wings vulnerable to Arbitrary File Write/Read in github.com/pterodactyl/wings

  GO-2024-2815: Pterodactyl Wings vulnerable to Server-Side Request Forgery during remote file pull in github.com/pterodactyl/wings

  GO-2026-4283: Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced in github.com/pterodactyl/wings

  GO-2026-4329: Pterodactyl endlessly reprocesses/reuploads activity log data due to SQLite max parameters limit not being considered in github.com/pterodactyl/wings

  GO-2026-4331: Pterodactyl websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks in github.com/pterodactyl/wings

  GO-2026-4497: Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change in github.com/pterodactyl/wings

  GO-2026-6120: Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions in github.com/pterodactyl/wings

  GO-2026-6156: Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service in github.com/pterodactyl/wings

  GO-2026-6158: Wings exposes node configuration secrets through egg configuration-file templating in github.com/pterodactyl/wings

  GO-2026-6159: Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM in github.com/pterodactyl/wings

Changes in this version

+ const DeletedEvent

type Configuration

+ Labels map[string]string

Nov 22, 2022 GO-2024-2642 +10 more

  GO-2024-2642: Pterodactyl Wings vulnerable to improper isolation of server file access in github.com/pterodactyl/wings

  GO-2024-2814: Pterodactyl Wings vulnerable to Arbitrary File Write/Read in github.com/pterodactyl/wings

  GO-2024-2815: Pterodactyl Wings vulnerable to Server-Side Request Forgery during remote file pull in github.com/pterodactyl/wings

  GO-2026-4283: Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced in github.com/pterodactyl/wings

  GO-2026-4329: Pterodactyl endlessly reprocesses/reuploads activity log data due to SQLite max parameters limit not being considered in github.com/pterodactyl/wings

  GO-2026-4331: Pterodactyl websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks in github.com/pterodactyl/wings

  GO-2026-4497: Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change in github.com/pterodactyl/wings

  GO-2026-6120: Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions in github.com/pterodactyl/wings

  GO-2026-6156: Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service in github.com/pterodactyl/wings

  GO-2026-6158: Wings exposes node configuration secrets through egg configuration-file templating in github.com/pterodactyl/wings

  GO-2026-6159: Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM in github.com/pterodactyl/wings

Nov 15, 2022 GO-2024-2642 +10 more

  GO-2024-2642: Pterodactyl Wings vulnerable to improper isolation of server file access in github.com/pterodactyl/wings

  GO-2024-2814: Pterodactyl Wings vulnerable to Arbitrary File Write/Read in github.com/pterodactyl/wings

  GO-2024-2815: Pterodactyl Wings vulnerable to Server-Side Request Forgery during remote file pull in github.com/pterodactyl/wings

  GO-2026-4283: Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced in github.com/pterodactyl/wings

  GO-2026-4329: Pterodactyl endlessly reprocesses/reuploads activity log data due to SQLite max parameters limit not being considered in github.com/pterodactyl/wings

  GO-2026-4331: Pterodactyl websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks in github.com/pterodactyl/wings

  GO-2026-4497: Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change in github.com/pterodactyl/wings

  GO-2026-6120: Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions in github.com/pterodactyl/wings

  GO-2026-6156: Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service in github.com/pterodactyl/wings

  GO-2026-6158: Wings exposes node configuration secrets through egg configuration-file templating in github.com/pterodactyl/wings

  GO-2026-6159: Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM in github.com/pterodactyl/wings

May 10, 2023 GO-2024-2642 +10 more

  GO-2024-2642: Pterodactyl Wings vulnerable to improper isolation of server file access in github.com/pterodactyl/wings

  GO-2024-2814: Pterodactyl Wings vulnerable to Arbitrary File Write/Read in github.com/pterodactyl/wings

  GO-2024-2815: Pterodactyl Wings vulnerable to Server-Side Request Forgery during remote file pull in github.com/pterodactyl/wings

  GO-2026-4283: Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced in github.com/pterodactyl/wings

  GO-2026-4329: Pterodactyl endlessly reprocesses/reuploads activity log data due to SQLite max parameters limit not being considered in github.com/pterodactyl/wings

  GO-2026-4331: Pterodactyl websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks in github.com/pterodactyl/wings

  GO-2026-4497: Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change in github.com/pterodactyl/wings

  GO-2026-6120: Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions in github.com/pterodactyl/wings

  GO-2026-6156: Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service in github.com/pterodactyl/wings

  GO-2026-6158: Wings exposes node configuration secrets through egg configuration-file templating in github.com/pterodactyl/wings

  GO-2026-6159: Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM in github.com/pterodactyl/wings

Feb 8, 2023 GO-2023-1768 +11 more

  GO-2023-1768: Wings vulnerable to escape to host from installation container in github.com/pterodactyl/wings

  GO-2024-2642: Pterodactyl Wings vulnerable to improper isolation of server file access in github.com/pterodactyl/wings

  GO-2024-2814: Pterodactyl Wings vulnerable to Arbitrary File Write/Read in github.com/pterodactyl/wings

  GO-2024-2815: Pterodactyl Wings vulnerable to Server-Side Request Forgery during remote file pull in github.com/pterodactyl/wings

  GO-2026-4283: Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced in github.com/pterodactyl/wings

  GO-2026-4329: Pterodactyl endlessly reprocesses/reuploads activity log data due to SQLite max parameters limit not being considered in github.com/pterodactyl/wings

  GO-2026-4331: Pterodactyl websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks in github.com/pterodactyl/wings

  GO-2026-4497: Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change in github.com/pterodactyl/wings

  GO-2026-6120: Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions in github.com/pterodactyl/wings

  GO-2026-6156: Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service in github.com/pterodactyl/wings

  GO-2026-6158: Wings exposes node configuration secrets through egg configuration-file templating in github.com/pterodactyl/wings

  GO-2026-6159: Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM in github.com/pterodactyl/wings

Feb 8, 2023 GO-2023-1555 +12 more

  GO-2023-1555: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following resulting in deletion of files and directories on the host system in github.com/pterodactyl/wings

  GO-2023-1768: Wings vulnerable to escape to host from installation container in github.com/pterodactyl/wings

  GO-2024-2642: Pterodactyl Wings vulnerable to improper isolation of server file access in github.com/pterodactyl/wings

  GO-2024-2814: Pterodactyl Wings vulnerable to Arbitrary File Write/Read in github.com/pterodactyl/wings

  GO-2024-2815: Pterodactyl Wings vulnerable to Server-Side Request Forgery during remote file pull in github.com/pterodactyl/wings

  GO-2026-4283: Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced in github.com/pterodactyl/wings

  GO-2026-4329: Pterodactyl endlessly reprocesses/reuploads activity log data due to SQLite max parameters limit not being considered in github.com/pterodactyl/wings

  GO-2026-4331: Pterodactyl websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks in github.com/pterodactyl/wings

  GO-2026-4497: Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change in github.com/pterodactyl/wings

  GO-2026-6120: Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions in github.com/pterodactyl/wings

  GO-2026-6156: Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service in github.com/pterodactyl/wings

  GO-2026-6158: Wings exposes node configuration secrets through egg configuration-file templating in github.com/pterodactyl/wings

  GO-2026-6159: Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM in github.com/pterodactyl/wings

Oct 5, 2022 GO-2023-1542 +13 more

  GO-2023-1542: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following in github.com/pterodactyl/wings

  GO-2023-1555: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following resulting in deletion of files and directories on the host system in github.com/pterodactyl/wings

  GO-2023-1768: Wings vulnerable to escape to host from installation container in github.com/pterodactyl/wings

  GO-2024-2642: Pterodactyl Wings vulnerable to improper isolation of server file access in github.com/pterodactyl/wings

  GO-2024-2814: Pterodactyl Wings vulnerable to Arbitrary File Write/Read in github.com/pterodactyl/wings

  GO-2024-2815: Pterodactyl Wings vulnerable to Server-Side Request Forgery during remote file pull in github.com/pterodactyl/wings

  GO-2026-4283: Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced in github.com/pterodactyl/wings

  GO-2026-4329: Pterodactyl endlessly reprocesses/reuploads activity log data due to SQLite max parameters limit not being considered in github.com/pterodactyl/wings

  GO-2026-4331: Pterodactyl websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks in github.com/pterodactyl/wings

  GO-2026-4497: Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change in github.com/pterodactyl/wings

  GO-2026-6120: Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions in github.com/pterodactyl/wings

  GO-2026-6156: Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service in github.com/pterodactyl/wings

  GO-2026-6158: Wings exposes node configuration secrets through egg configuration-file templating in github.com/pterodactyl/wings

  GO-2026-6159: Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM in github.com/pterodactyl/wings

Sep 26, 2022 GO-2023-1542 +13 more

  GO-2023-1542: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following in github.com/pterodactyl/wings

  GO-2023-1555: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following resulting in deletion of files and directories on the host system in github.com/pterodactyl/wings

  GO-2023-1768: Wings vulnerable to escape to host from installation container in github.com/pterodactyl/wings

  GO-2024-2642: Pterodactyl Wings vulnerable to improper isolation of server file access in github.com/pterodactyl/wings

  GO-2024-2814: Pterodactyl Wings vulnerable to Arbitrary File Write/Read in github.com/pterodactyl/wings

  GO-2024-2815: Pterodactyl Wings vulnerable to Server-Side Request Forgery during remote file pull in github.com/pterodactyl/wings

  GO-2026-4283: Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced in github.com/pterodactyl/wings

  GO-2026-4329: Pterodactyl endlessly reprocesses/reuploads activity log data due to SQLite max parameters limit not being considered in github.com/pterodactyl/wings

  GO-2026-4331: Pterodactyl websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks in github.com/pterodactyl/wings

  GO-2026-4497: Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change in github.com/pterodactyl/wings

  GO-2026-6120: Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions in github.com/pterodactyl/wings

  GO-2026-6156: Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service in github.com/pterodactyl/wings

  GO-2026-6158: Wings exposes node configuration secrets through egg configuration-file templating in github.com/pterodactyl/wings

  GO-2026-6159: Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM in github.com/pterodactyl/wings

Jul 24, 2022 GO-2023-1542 +13 more

  GO-2023-1542: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following in github.com/pterodactyl/wings

  GO-2023-1555: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following resulting in deletion of files and directories on the host system in github.com/pterodactyl/wings

  GO-2023-1768: Wings vulnerable to escape to host from installation container in github.com/pterodactyl/wings

  GO-2024-2642: Pterodactyl Wings vulnerable to improper isolation of server file access in github.com/pterodactyl/wings

  GO-2024-2814: Pterodactyl Wings vulnerable to Arbitrary File Write/Read in github.com/pterodactyl/wings

  GO-2024-2815: Pterodactyl Wings vulnerable to Server-Side Request Forgery during remote file pull in github.com/pterodactyl/wings

  GO-2026-4283: Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced in github.com/pterodactyl/wings

  GO-2026-4329: Pterodactyl endlessly reprocesses/reuploads activity log data due to SQLite max parameters limit not being considered in github.com/pterodactyl/wings

  GO-2026-4331: Pterodactyl websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks in github.com/pterodactyl/wings

  GO-2026-4497: Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change in github.com/pterodactyl/wings

  GO-2026-6120: Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions in github.com/pterodactyl/wings

  GO-2026-6156: Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service in github.com/pterodactyl/wings

  GO-2026-6158: Wings exposes node configuration secrets through egg configuration-file templating in github.com/pterodactyl/wings

  GO-2026-6159: Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM in github.com/pterodactyl/wings

Changes in this version

+ const ActivityConsoleCommand

+ const ActivityFileUploaded

+ const ActivityPowerPrefix

+ const ActivitySftpCreate

+ const ActivitySftpCreateDirectory

+ const ActivitySftpDelete

+ const ActivitySftpRename

+ const ActivitySftpWrite

type Configuration

+ Meta ConfigurationMeta

+ type ConfigurationMeta struct

+ Description string

+ Name string

type Manager

+ func (m *Manager) Keys() []string

+ func (m *Manager) Len() int

+ type RequestActivity struct

+ func (ra RequestActivity) Event(event models.Event, metadata models.ActivityMeta) *models.Activity

+ func (ra RequestActivity) SetUser(u string) RequestActivity

type Server

+ func (s *Server) NewRequestActivity(user string, ip string) RequestActivity

+ func (s *Server) SaveActivity(a RequestActivity, event models.Event, metadata models.ActivityMeta)

May 31, 2022 GO-2023-1542 +12 more

  GO-2023-1542: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following in github.com/pterodactyl/wings

  GO-2023-1555: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following resulting in deletion of files and directories on the host system in github.com/pterodactyl/wings

  GO-2023-1768: Wings vulnerable to escape to host from installation container in github.com/pterodactyl/wings

  GO-2024-2642: Pterodactyl Wings vulnerable to improper isolation of server file access in github.com/pterodactyl/wings

  GO-2024-2814: Pterodactyl Wings vulnerable to Arbitrary File Write/Read in github.com/pterodactyl/wings

  GO-2024-2815: Pterodactyl Wings vulnerable to Server-Side Request Forgery during remote file pull in github.com/pterodactyl/wings

  GO-2026-4283: Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced in github.com/pterodactyl/wings

  GO-2026-4331: Pterodactyl websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks in github.com/pterodactyl/wings

  GO-2026-4497: Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change in github.com/pterodactyl/wings

  GO-2026-6120: Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions in github.com/pterodactyl/wings

  GO-2026-6156: Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service in github.com/pterodactyl/wings

  GO-2026-6158: Wings exposes node configuration secrets through egg configuration-file templating in github.com/pterodactyl/wings

  GO-2026-6159: Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM in github.com/pterodactyl/wings

May 30, 2022 GO-2023-1542 +12 more

  GO-2023-1542: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following in github.com/pterodactyl/wings

  GO-2023-1555: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following resulting in deletion of files and directories on the host system in github.com/pterodactyl/wings

  GO-2023-1768: Wings vulnerable to escape to host from installation container in github.com/pterodactyl/wings

  GO-2024-2642: Pterodactyl Wings vulnerable to improper isolation of server file access in github.com/pterodactyl/wings

  GO-2024-2814: Pterodactyl Wings vulnerable to Arbitrary File Write/Read in github.com/pterodactyl/wings

  GO-2024-2815: Pterodactyl Wings vulnerable to Server-Side Request Forgery during remote file pull in github.com/pterodactyl/wings

  GO-2026-4283: Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced in github.com/pterodactyl/wings

  GO-2026-4331: Pterodactyl websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks in github.com/pterodactyl/wings

  GO-2026-4497: Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change in github.com/pterodactyl/wings

  GO-2026-6120: Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions in github.com/pterodactyl/wings

  GO-2026-6156: Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service in github.com/pterodactyl/wings

  GO-2026-6158: Wings exposes node configuration secrets through egg configuration-file templating in github.com/pterodactyl/wings

  GO-2026-6159: Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM in github.com/pterodactyl/wings

May 21, 2022 GO-2023-1542 +12 more

  GO-2023-1542: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following in github.com/pterodactyl/wings

  GO-2023-1555: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following resulting in deletion of files and directories on the host system in github.com/pterodactyl/wings

  GO-2023-1768: Wings vulnerable to escape to host from installation container in github.com/pterodactyl/wings

  GO-2024-2642: Pterodactyl Wings vulnerable to improper isolation of server file access in github.com/pterodactyl/wings

  GO-2024-2814: Pterodactyl Wings vulnerable to Arbitrary File Write/Read in github.com/pterodactyl/wings

  GO-2024-2815: Pterodactyl Wings vulnerable to Server-Side Request Forgery during remote file pull in github.com/pterodactyl/wings

  GO-2026-4283: Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced in github.com/pterodactyl/wings

  GO-2026-4331: Pterodactyl websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks in github.com/pterodactyl/wings

  GO-2026-4497: Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change in github.com/pterodactyl/wings

  GO-2026-6120: Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions in github.com/pterodactyl/wings

  GO-2026-6156: Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service in github.com/pterodactyl/wings

  GO-2026-6158: Wings exposes node configuration secrets through egg configuration-file templating in github.com/pterodactyl/wings

  GO-2026-6159: Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM in github.com/pterodactyl/wings

Feb 5, 2022 GO-2023-1542 +12 more

  GO-2023-1542: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following in github.com/pterodactyl/wings

  GO-2023-1555: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following resulting in deletion of files and directories on the host system in github.com/pterodactyl/wings

  GO-2023-1768: Wings vulnerable to escape to host from installation container in github.com/pterodactyl/wings

  GO-2024-2642: Pterodactyl Wings vulnerable to improper isolation of server file access in github.com/pterodactyl/wings

  GO-2024-2814: Pterodactyl Wings vulnerable to Arbitrary File Write/Read in github.com/pterodactyl/wings

  GO-2024-2815: Pterodactyl Wings vulnerable to Server-Side Request Forgery during remote file pull in github.com/pterodactyl/wings

  GO-2026-4283: Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced in github.com/pterodactyl/wings

  GO-2026-4331: Pterodactyl websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks in github.com/pterodactyl/wings

  GO-2026-4497: Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change in github.com/pterodactyl/wings

  GO-2026-6120: Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions in github.com/pterodactyl/wings

  GO-2026-6156: Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service in github.com/pterodactyl/wings

  GO-2026-6158: Wings exposes node configuration secrets through egg configuration-file templating in github.com/pterodactyl/wings

  GO-2026-6159: Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM in github.com/pterodactyl/wings

Jan 31, 2022 GO-2023-1542 +12 more

  GO-2023-1542: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following in github.com/pterodactyl/wings

  GO-2023-1555: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following resulting in deletion of files and directories on the host system in github.com/pterodactyl/wings

  GO-2023-1768: Wings vulnerable to escape to host from installation container in github.com/pterodactyl/wings

  GO-2024-2642: Pterodactyl Wings vulnerable to improper isolation of server file access in github.com/pterodactyl/wings

  GO-2024-2814: Pterodactyl Wings vulnerable to Arbitrary File Write/Read in github.com/pterodactyl/wings

  GO-2024-2815: Pterodactyl Wings vulnerable to Server-Side Request Forgery during remote file pull in github.com/pterodactyl/wings

  GO-2026-4283: Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced in github.com/pterodactyl/wings

  GO-2026-4331: Pterodactyl websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks in github.com/pterodactyl/wings

  GO-2026-4497: Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change in github.com/pterodactyl/wings

  GO-2026-6120: Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions in github.com/pterodactyl/wings

  GO-2026-6156: Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service in github.com/pterodactyl/wings

  GO-2026-6158: Wings exposes node configuration secrets through egg configuration-file templating in github.com/pterodactyl/wings

  GO-2026-6159: Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM in github.com/pterodactyl/wings

Changes in this version

+ type ConsoleThrottle struct

+ func (ct *ConsoleThrottle) Allow() bool

+ func (ct *ConsoleThrottle) Reset()

type ResourceUsage

+ func (ru *ResourceUsage) UpdateStats(stats environment.Stats)

Jan 23, 2022 GO-2023-1542 +12 more

  GO-2023-1542: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following in github.com/pterodactyl/wings

  GO-2023-1555: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following resulting in deletion of files and directories on the host system in github.com/pterodactyl/wings

  GO-2023-1768: Wings vulnerable to escape to host from installation container in github.com/pterodactyl/wings

  GO-2024-2642: Pterodactyl Wings vulnerable to improper isolation of server file access in github.com/pterodactyl/wings

  GO-2024-2814: Pterodactyl Wings vulnerable to Arbitrary File Write/Read in github.com/pterodactyl/wings

  GO-2024-2815: Pterodactyl Wings vulnerable to Server-Side Request Forgery during remote file pull in github.com/pterodactyl/wings

  GO-2026-4283: Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced in github.com/pterodactyl/wings

  GO-2026-4331: Pterodactyl websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks in github.com/pterodactyl/wings

  GO-2026-4497: Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change in github.com/pterodactyl/wings

  GO-2026-6120: Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions in github.com/pterodactyl/wings

  GO-2026-6156: Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service in github.com/pterodactyl/wings

  GO-2026-6158: Wings exposes node configuration secrets through egg configuration-file templating in github.com/pterodactyl/wings

  GO-2026-6159: Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM in github.com/pterodactyl/wings

Changes in this version

+ var ErrPowerLockerLocked error = errPowerLockerLocked

type Server

+ func (s *Server) CleanupForDestroy()

+ func (s *Server) DestroyAllSinks()

+ func (s *Server) Sink(name SinkName) *sinkPool

+ type SinkName string

+ const InstallSink

+ const LogSink

Jan 20, 2022 GO-2023-1542 +12 more

  GO-2023-1542: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following in github.com/pterodactyl/wings

  GO-2023-1555: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following resulting in deletion of files and directories on the host system in github.com/pterodactyl/wings

  GO-2023-1768: Wings vulnerable to escape to host from installation container in github.com/pterodactyl/wings

  GO-2024-2642: Pterodactyl Wings vulnerable to improper isolation of server file access in github.com/pterodactyl/wings

  GO-2024-2814: Pterodactyl Wings vulnerable to Arbitrary File Write/Read in github.com/pterodactyl/wings

  GO-2024-2815: Pterodactyl Wings vulnerable to Server-Side Request Forgery during remote file pull in github.com/pterodactyl/wings

  GO-2026-4283: Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced in github.com/pterodactyl/wings

  GO-2026-4331: Pterodactyl websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks in github.com/pterodactyl/wings

  GO-2026-4497: Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change in github.com/pterodactyl/wings

  GO-2026-6120: Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions in github.com/pterodactyl/wings

  GO-2026-6156: Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service in github.com/pterodactyl/wings

  GO-2026-6158: Wings exposes node configuration secrets through egg configuration-file templating in github.com/pterodactyl/wings

  GO-2026-6159: Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM in github.com/pterodactyl/wings

Jan 20, 2022 GO-2023-1542 +12 more

  GO-2023-1542: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following in github.com/pterodactyl/wings

  GO-2023-1555: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following resulting in deletion of files and directories on the host system in github.com/pterodactyl/wings

  GO-2023-1768: Wings vulnerable to escape to host from installation container in github.com/pterodactyl/wings

  GO-2024-2642: Pterodactyl Wings vulnerable to improper isolation of server file access in github.com/pterodactyl/wings

  GO-2024-2814: Pterodactyl Wings vulnerable to Arbitrary File Write/Read in github.com/pterodactyl/wings

  GO-2024-2815: Pterodactyl Wings vulnerable to Server-Side Request Forgery during remote file pull in github.com/pterodactyl/wings

  GO-2026-4283: Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced in github.com/pterodactyl/wings

  GO-2026-4331: Pterodactyl websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks in github.com/pterodactyl/wings

  GO-2026-4497: Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change in github.com/pterodactyl/wings

  GO-2026-6120: Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions in github.com/pterodactyl/wings

  GO-2026-6156: Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service in github.com/pterodactyl/wings

  GO-2026-6158: Wings exposes node configuration secrets through egg configuration-file templating in github.com/pterodactyl/wings

  GO-2026-6159: Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM in github.com/pterodactyl/wings

Changes in this version

type Server

+ func (s *Server) InstallSink() *sinkPool

+ func (s *Server) LogSink() *sinkPool

Oct 26, 2021 GO-2023-1542 +12 more

  GO-2023-1542: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following in github.com/pterodactyl/wings

  GO-2023-1555: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following resulting in deletion of files and directories on the host system in github.com/pterodactyl/wings

  GO-2023-1768: Wings vulnerable to escape to host from installation container in github.com/pterodactyl/wings

  GO-2024-2642: Pterodactyl Wings vulnerable to improper isolation of server file access in github.com/pterodactyl/wings

  GO-2024-2814: Pterodactyl Wings vulnerable to Arbitrary File Write/Read in github.com/pterodactyl/wings

  GO-2024-2815: Pterodactyl Wings vulnerable to Server-Side Request Forgery during remote file pull in github.com/pterodactyl/wings

  GO-2026-4283: Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced in github.com/pterodactyl/wings

  GO-2026-4331: Pterodactyl websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks in github.com/pterodactyl/wings

  GO-2026-4497: Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change in github.com/pterodactyl/wings

  GO-2026-6120: Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions in github.com/pterodactyl/wings

  GO-2026-6156: Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service in github.com/pterodactyl/wings

  GO-2026-6158: Wings exposes node configuration secrets through egg configuration-file templating in github.com/pterodactyl/wings

  GO-2026-6159: Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM in github.com/pterodactyl/wings

Oct 23, 2021 GO-2023-1542 +12 more

  GO-2023-1542: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following in github.com/pterodactyl/wings

  GO-2023-1555: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following resulting in deletion of files and directories on the host system in github.com/pterodactyl/wings

  GO-2023-1768: Wings vulnerable to escape to host from installation container in github.com/pterodactyl/wings

  GO-2024-2642: Pterodactyl Wings vulnerable to improper isolation of server file access in github.com/pterodactyl/wings

  GO-2024-2814: Pterodactyl Wings vulnerable to Arbitrary File Write/Read in github.com/pterodactyl/wings

  GO-2024-2815: Pterodactyl Wings vulnerable to Server-Side Request Forgery during remote file pull in github.com/pterodactyl/wings

  GO-2026-4283: Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced in github.com/pterodactyl/wings

  GO-2026-4331: Pterodactyl websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks in github.com/pterodactyl/wings

  GO-2026-4497: Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change in github.com/pterodactyl/wings

  GO-2026-6120: Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions in github.com/pterodactyl/wings

  GO-2026-6156: Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service in github.com/pterodactyl/wings

  GO-2026-6158: Wings exposes node configuration secrets through egg configuration-file templating in github.com/pterodactyl/wings

  GO-2026-6159: Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM in github.com/pterodactyl/wings

Sep 16, 2021 GO-2023-1542 +12 more

  GO-2023-1542: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following in github.com/pterodactyl/wings

  GO-2023-1555: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following resulting in deletion of files and directories on the host system in github.com/pterodactyl/wings

  GO-2023-1768: Wings vulnerable to escape to host from installation container in github.com/pterodactyl/wings

  GO-2024-2642: Pterodactyl Wings vulnerable to improper isolation of server file access in github.com/pterodactyl/wings

  GO-2024-2814: Pterodactyl Wings vulnerable to Arbitrary File Write/Read in github.com/pterodactyl/wings

  GO-2024-2815: Pterodactyl Wings vulnerable to Server-Side Request Forgery during remote file pull in github.com/pterodactyl/wings

  GO-2026-4283: Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced in github.com/pterodactyl/wings

  GO-2026-4331: Pterodactyl websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks in github.com/pterodactyl/wings

  GO-2026-4497: Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change in github.com/pterodactyl/wings

  GO-2026-6120: Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions in github.com/pterodactyl/wings

  GO-2026-6156: Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service in github.com/pterodactyl/wings

  GO-2026-6158: Wings exposes node configuration secrets through egg configuration-file templating in github.com/pterodactyl/wings

  GO-2026-6159: Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM in github.com/pterodactyl/wings

Sep 12, 2021 GO-2023-1542 +12 more

  GO-2023-1542: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following in github.com/pterodactyl/wings

  GO-2023-1555: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following resulting in deletion of files and directories on the host system in github.com/pterodactyl/wings

  GO-2023-1768: Wings vulnerable to escape to host from installation container in github.com/pterodactyl/wings

  GO-2024-2642: Pterodactyl Wings vulnerable to improper isolation of server file access in github.com/pterodactyl/wings

  GO-2024-2814: Pterodactyl Wings vulnerable to Arbitrary File Write/Read in github.com/pterodactyl/wings

  GO-2024-2815: Pterodactyl Wings vulnerable to Server-Side Request Forgery during remote file pull in github.com/pterodactyl/wings

  GO-2026-4283: Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced in github.com/pterodactyl/wings

  GO-2026-4331: Pterodactyl websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks in github.com/pterodactyl/wings

  GO-2026-4497: Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change in github.com/pterodactyl/wings

  GO-2026-6120: Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions in github.com/pterodactyl/wings

  GO-2026-6156: Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service in github.com/pterodactyl/wings

  GO-2026-6158: Wings exposes node configuration secrets through egg configuration-file templating in github.com/pterodactyl/wings

  GO-2026-6159: Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM in github.com/pterodactyl/wings

Aug 4, 2021 GO-2023-1542 +12 more

  GO-2023-1542: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following in github.com/pterodactyl/wings

  GO-2023-1555: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following resulting in deletion of files and directories on the host system in github.com/pterodactyl/wings

  GO-2023-1768: Wings vulnerable to escape to host from installation container in github.com/pterodactyl/wings

  GO-2024-2642: Pterodactyl Wings vulnerable to improper isolation of server file access in github.com/pterodactyl/wings

  GO-2024-2814: Pterodactyl Wings vulnerable to Arbitrary File Write/Read in github.com/pterodactyl/wings

  GO-2024-2815: Pterodactyl Wings vulnerable to Server-Side Request Forgery during remote file pull in github.com/pterodactyl/wings

  GO-2026-4283: Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced in github.com/pterodactyl/wings

  GO-2026-4331: Pterodactyl websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks in github.com/pterodactyl/wings

  GO-2026-4497: Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change in github.com/pterodactyl/wings

  GO-2026-6120: Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions in github.com/pterodactyl/wings

  GO-2026-6156: Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service in github.com/pterodactyl/wings

  GO-2026-6158: Wings exposes node configuration secrets through egg configuration-file templating in github.com/pterodactyl/wings

  GO-2026-6159: Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM in github.com/pterodactyl/wings

Changes in this version

type Configuration

+ StartOnCompletion bool

type Server

+ func (s *Server) ID() string

Aug 3, 2021 GO-2023-1542 +12 more

  GO-2023-1542: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following in github.com/pterodactyl/wings

  GO-2023-1555: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following resulting in deletion of files and directories on the host system in github.com/pterodactyl/wings

  GO-2023-1768: Wings vulnerable to escape to host from installation container in github.com/pterodactyl/wings

  GO-2024-2642: Pterodactyl Wings vulnerable to improper isolation of server file access in github.com/pterodactyl/wings

  GO-2024-2814: Pterodactyl Wings vulnerable to Arbitrary File Write/Read in github.com/pterodactyl/wings

  GO-2024-2815: Pterodactyl Wings vulnerable to Server-Side Request Forgery during remote file pull in github.com/pterodactyl/wings

  GO-2026-4283: Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced in github.com/pterodactyl/wings

  GO-2026-4331: Pterodactyl websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks in github.com/pterodactyl/wings

  GO-2026-4497: Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change in github.com/pterodactyl/wings

  GO-2026-6120: Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions in github.com/pterodactyl/wings

  GO-2026-6156: Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service in github.com/pterodactyl/wings

  GO-2026-6158: Wings exposes node configuration secrets through egg configuration-file templating in github.com/pterodactyl/wings

  GO-2026-6159: Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM in github.com/pterodactyl/wings

Jun 29, 2021 GO-2023-1542 +12 more

  GO-2023-1542: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following in github.com/pterodactyl/wings

  GO-2023-1555: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following resulting in deletion of files and directories on the host system in github.com/pterodactyl/wings

  GO-2023-1768: Wings vulnerable to escape to host from installation container in github.com/pterodactyl/wings

  GO-2024-2642: Pterodactyl Wings vulnerable to improper isolation of server file access in github.com/pterodactyl/wings

  GO-2024-2814: Pterodactyl Wings vulnerable to Arbitrary File Write/Read in github.com/pterodactyl/wings

  GO-2024-2815: Pterodactyl Wings vulnerable to Server-Side Request Forgery during remote file pull in github.com/pterodactyl/wings

  GO-2026-4283: Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced in github.com/pterodactyl/wings

  GO-2026-4331: Pterodactyl websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks in github.com/pterodactyl/wings

  GO-2026-4497: Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change in github.com/pterodactyl/wings

  GO-2026-6120: Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions in github.com/pterodactyl/wings

  GO-2026-6156: Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service in github.com/pterodactyl/wings

  GO-2026-6158: Wings exposes node configuration secrets through egg configuration-file templating in github.com/pterodactyl/wings

  GO-2026-6159: Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM in github.com/pterodactyl/wings

Jun 21, 2021 GO-2023-1542 +12 more

  GO-2023-1542: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following in github.com/pterodactyl/wings

  GO-2023-1555: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following resulting in deletion of files and directories on the host system in github.com/pterodactyl/wings

  GO-2023-1768: Wings vulnerable to escape to host from installation container in github.com/pterodactyl/wings

  GO-2024-2642: Pterodactyl Wings vulnerable to improper isolation of server file access in github.com/pterodactyl/wings

  GO-2024-2814: Pterodactyl Wings vulnerable to Arbitrary File Write/Read in github.com/pterodactyl/wings

  GO-2024-2815: Pterodactyl Wings vulnerable to Server-Side Request Forgery during remote file pull in github.com/pterodactyl/wings

  GO-2026-4283: Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced in github.com/pterodactyl/wings

  GO-2026-4331: Pterodactyl websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks in github.com/pterodactyl/wings

  GO-2026-4497: Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change in github.com/pterodactyl/wings

  GO-2026-6120: Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions in github.com/pterodactyl/wings

  GO-2026-6156: Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service in github.com/pterodactyl/wings

  GO-2026-6158: Wings exposes node configuration secrets through egg configuration-file templating in github.com/pterodactyl/wings

  GO-2026-6159: Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM in github.com/pterodactyl/wings

Jun 5, 2021 GO-2022-0919 +13 more

  GO-2022-0919: Asymmetric Resource Consumption (Amplification) in Docker containers created by Wings in github.com/pterodactyl/wings

  GO-2023-1542: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following in github.com/pterodactyl/wings

  GO-2023-1555: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following resulting in deletion of files and directories on the host system in github.com/pterodactyl/wings

  GO-2023-1768: Wings vulnerable to escape to host from installation container in github.com/pterodactyl/wings

  GO-2024-2642: Pterodactyl Wings vulnerable to improper isolation of server file access in github.com/pterodactyl/wings

  GO-2024-2814: Pterodactyl Wings vulnerable to Arbitrary File Write/Read in github.com/pterodactyl/wings

  GO-2024-2815: Pterodactyl Wings vulnerable to Server-Side Request Forgery during remote file pull in github.com/pterodactyl/wings

  GO-2026-4283: Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced in github.com/pterodactyl/wings

  GO-2026-4331: Pterodactyl websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks in github.com/pterodactyl/wings

  GO-2026-4497: Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change in github.com/pterodactyl/wings

  GO-2026-6120: Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions in github.com/pterodactyl/wings

  GO-2026-6156: Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service in github.com/pterodactyl/wings

  GO-2026-6158: Wings exposes node configuration secrets through egg configuration-file templating in github.com/pterodactyl/wings

  GO-2026-6159: Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM in github.com/pterodactyl/wings

May 2, 2021 GO-2022-0919 +13 more

  GO-2022-0919: Asymmetric Resource Consumption (Amplification) in Docker containers created by Wings in github.com/pterodactyl/wings

  GO-2023-1542: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following in github.com/pterodactyl/wings

  GO-2023-1555: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following resulting in deletion of files and directories on the host system in github.com/pterodactyl/wings

  GO-2023-1768: Wings vulnerable to escape to host from installation container in github.com/pterodactyl/wings

  GO-2024-2642: Pterodactyl Wings vulnerable to improper isolation of server file access in github.com/pterodactyl/wings

  GO-2024-2814: Pterodactyl Wings vulnerable to Arbitrary File Write/Read in github.com/pterodactyl/wings

  GO-2024-2815: Pterodactyl Wings vulnerable to Server-Side Request Forgery during remote file pull in github.com/pterodactyl/wings

  GO-2026-4283: Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced in github.com/pterodactyl/wings

  GO-2026-4331: Pterodactyl websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks in github.com/pterodactyl/wings

  GO-2026-4497: Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change in github.com/pterodactyl/wings

  GO-2026-6120: Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions in github.com/pterodactyl/wings

  GO-2026-6156: Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service in github.com/pterodactyl/wings

  GO-2026-6158: Wings exposes node configuration secrets through egg configuration-file templating in github.com/pterodactyl/wings

  GO-2026-6159: Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM in github.com/pterodactyl/wings

Apr 28, 2021 GO-2022-0919 +13 more

  GO-2022-0919: Asymmetric Resource Consumption (Amplification) in Docker containers created by Wings in github.com/pterodactyl/wings

  GO-2023-1542: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following in github.com/pterodactyl/wings

  GO-2023-1555: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following resulting in deletion of files and directories on the host system in github.com/pterodactyl/wings

  GO-2023-1768: Wings vulnerable to escape to host from installation container in github.com/pterodactyl/wings

  GO-2024-2642: Pterodactyl Wings vulnerable to improper isolation of server file access in github.com/pterodactyl/wings

  GO-2024-2814: Pterodactyl Wings vulnerable to Arbitrary File Write/Read in github.com/pterodactyl/wings

  GO-2024-2815: Pterodactyl Wings vulnerable to Server-Side Request Forgery during remote file pull in github.com/pterodactyl/wings

  GO-2026-4283: Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced in github.com/pterodactyl/wings

  GO-2026-4331: Pterodactyl websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks in github.com/pterodactyl/wings

  GO-2026-4497: Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change in github.com/pterodactyl/wings

  GO-2026-6120: Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions in github.com/pterodactyl/wings

  GO-2026-6156: Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service in github.com/pterodactyl/wings

  GO-2026-6158: Wings exposes node configuration secrets through egg configuration-file templating in github.com/pterodactyl/wings

  GO-2026-6159: Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM in github.com/pterodactyl/wings

Apr 24, 2021 GO-2022-0919 +13 more

  GO-2022-0919: Asymmetric Resource Consumption (Amplification) in Docker containers created by Wings in github.com/pterodactyl/wings

  GO-2023-1542: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following in github.com/pterodactyl/wings

  GO-2023-1555: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following resulting in deletion of files and directories on the host system in github.com/pterodactyl/wings

  GO-2023-1768: Wings vulnerable to escape to host from installation container in github.com/pterodactyl/wings

  GO-2024-2642: Pterodactyl Wings vulnerable to improper isolation of server file access in github.com/pterodactyl/wings

  GO-2024-2814: Pterodactyl Wings vulnerable to Arbitrary File Write/Read in github.com/pterodactyl/wings

  GO-2024-2815: Pterodactyl Wings vulnerable to Server-Side Request Forgery during remote file pull in github.com/pterodactyl/wings

  GO-2026-4283: Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced in github.com/pterodactyl/wings

  GO-2026-4331: Pterodactyl websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks in github.com/pterodactyl/wings

  GO-2026-4497: Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change in github.com/pterodactyl/wings

  GO-2026-6120: Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions in github.com/pterodactyl/wings

  GO-2026-6156: Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service in github.com/pterodactyl/wings

  GO-2026-6158: Wings exposes node configuration secrets through egg configuration-file templating in github.com/pterodactyl/wings

  GO-2026-6159: Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM in github.com/pterodactyl/wings

Changes in this version

+ type APIResponse struct

+ Configuration Configuration

+ IsSuspended bool

+ State string

+ Utilization ResourceUsage

type Server

+ func (s *Server) ToAPIResponse() APIResponse

Mar 12, 2021 GO-2022-0919 +13 more

  GO-2022-0919: Asymmetric Resource Consumption (Amplification) in Docker containers created by Wings in github.com/pterodactyl/wings

  GO-2023-1542: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following in github.com/pterodactyl/wings

  GO-2023-1555: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following resulting in deletion of files and directories on the host system in github.com/pterodactyl/wings

  GO-2023-1768: Wings vulnerable to escape to host from installation container in github.com/pterodactyl/wings

  GO-2024-2642: Pterodactyl Wings vulnerable to improper isolation of server file access in github.com/pterodactyl/wings

  GO-2024-2814: Pterodactyl Wings vulnerable to Arbitrary File Write/Read in github.com/pterodactyl/wings

  GO-2024-2815: Pterodactyl Wings vulnerable to Server-Side Request Forgery during remote file pull in github.com/pterodactyl/wings

  GO-2026-4283: Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced in github.com/pterodactyl/wings

  GO-2026-4331: Pterodactyl websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks in github.com/pterodactyl/wings

  GO-2026-4497: Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change in github.com/pterodactyl/wings

  GO-2026-6120: Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions in github.com/pterodactyl/wings

  GO-2026-6156: Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service in github.com/pterodactyl/wings

  GO-2026-6158: Wings exposes node configuration secrets through egg configuration-file templating in github.com/pterodactyl/wings

  GO-2026-6159: Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM in github.com/pterodactyl/wings

Changes in this version

+ var ErrServerIsRestoring = errors.New("server is currently being restored")

type Server

+ func (s *Server) IsRestoring() bool

+ func (s *Server) SetRestoring(state bool)

Mar 8, 2021 GO-2022-0919 +13 more

  GO-2022-0919: Asymmetric Resource Consumption (Amplification) in Docker containers created by Wings in github.com/pterodactyl/wings

  GO-2023-1542: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following in github.com/pterodactyl/wings

  GO-2023-1555: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following resulting in deletion of files and directories on the host system in github.com/pterodactyl/wings

  GO-2023-1768: Wings vulnerable to escape to host from installation container in github.com/pterodactyl/wings

  GO-2024-2642: Pterodactyl Wings vulnerable to improper isolation of server file access in github.com/pterodactyl/wings

  GO-2024-2814: Pterodactyl Wings vulnerable to Arbitrary File Write/Read in github.com/pterodactyl/wings

  GO-2024-2815: Pterodactyl Wings vulnerable to Server-Side Request Forgery during remote file pull in github.com/pterodactyl/wings

  GO-2026-4283: Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced in github.com/pterodactyl/wings

  GO-2026-4331: Pterodactyl websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks in github.com/pterodactyl/wings

  GO-2026-4497: Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change in github.com/pterodactyl/wings

  GO-2026-6120: Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions in github.com/pterodactyl/wings

  GO-2026-6156: Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service in github.com/pterodactyl/wings

  GO-2026-6158: Wings exposes node configuration secrets through egg configuration-file templating in github.com/pterodactyl/wings

  GO-2026-6159: Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM in github.com/pterodactyl/wings

Mar 4, 2021 GO-2022-0919 +13 more

  GO-2022-0919: Asymmetric Resource Consumption (Amplification) in Docker containers created by Wings in github.com/pterodactyl/wings

  GO-2023-1542: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following in github.com/pterodactyl/wings

  GO-2023-1555: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following resulting in deletion of files and directories on the host system in github.com/pterodactyl/wings

  GO-2023-1768: Wings vulnerable to escape to host from installation container in github.com/pterodactyl/wings

  GO-2024-2642: Pterodactyl Wings vulnerable to improper isolation of server file access in github.com/pterodactyl/wings

  GO-2024-2814: Pterodactyl Wings vulnerable to Arbitrary File Write/Read in github.com/pterodactyl/wings

  GO-2024-2815: Pterodactyl Wings vulnerable to Server-Side Request Forgery during remote file pull in github.com/pterodactyl/wings

  GO-2026-4283: Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced in github.com/pterodactyl/wings

  GO-2026-4331: Pterodactyl websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks in github.com/pterodactyl/wings

  GO-2026-4497: Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change in github.com/pterodactyl/wings

  GO-2026-6120: Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions in github.com/pterodactyl/wings

  GO-2026-6156: Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service in github.com/pterodactyl/wings

  GO-2026-6158: Wings exposes node configuration secrets through egg configuration-file templating in github.com/pterodactyl/wings

  GO-2026-6159: Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM in github.com/pterodactyl/wings

Changes in this version

+ const BackupRestoreCompletedEvent

type Configuration

+ Egg EggConfiguration

+ type EggConfiguration struct

+ FileDenylist []string

+ ID string

+ type Manager struct

+ func NewEmptyManager(client remote.Client) *Manager

+ func NewManager(ctx context.Context, client remote.Client) (*Manager, error)

+ func (m *Manager) Add(s *Server)

+ func (m *Manager) All() []*Server

+ func (m *Manager) Client() remote.Client

+ func (m *Manager) Filter(filter func(match *Server) bool) []*Server

+ func (m *Manager) Find(filter func(match *Server) bool) *Server

+ func (m *Manager) Get(uuid string) (*Server, bool)

+ func (m *Manager) InitServer(data remote.ServerConfigurationResponse) (*Server, error)

+ func (m *Manager) PersistStates() error

+ func (m *Manager) Put(s []*Server)

+ func (m *Manager) ReadStates() (map[string]string, error)

+ func (m *Manager) Remove(filter func(match *Server) bool)

type Server

+ func (s *Server) RestoreBackup(b backup.BackupInterface, reader io.ReadCloser) (err error)

Jan 10, 2021 GO-2022-0919 +13 more

  GO-2022-0919: Asymmetric Resource Consumption (Amplification) in Docker containers created by Wings in github.com/pterodactyl/wings

  GO-2023-1542: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following in github.com/pterodactyl/wings

  GO-2023-1555: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following resulting in deletion of files and directories on the host system in github.com/pterodactyl/wings

  GO-2023-1768: Wings vulnerable to escape to host from installation container in github.com/pterodactyl/wings

  GO-2024-2642: Pterodactyl Wings vulnerable to improper isolation of server file access in github.com/pterodactyl/wings

  GO-2024-2814: Pterodactyl Wings vulnerable to Arbitrary File Write/Read in github.com/pterodactyl/wings

  GO-2024-2815: Pterodactyl Wings vulnerable to Server-Side Request Forgery during remote file pull in github.com/pterodactyl/wings

  GO-2026-4283: Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced in github.com/pterodactyl/wings

  GO-2026-4331: Pterodactyl websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks in github.com/pterodactyl/wings

  GO-2026-4497: Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change in github.com/pterodactyl/wings

  GO-2026-6120: Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions in github.com/pterodactyl/wings

  GO-2026-6156: Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service in github.com/pterodactyl/wings

  GO-2026-6158: Wings exposes node configuration secrets through egg configuration-file templating in github.com/pterodactyl/wings

  GO-2026-6159: Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM in github.com/pterodactyl/wings

Jan 9, 2021 GO-2022-0919 +13 more

  GO-2022-0919: Asymmetric Resource Consumption (Amplification) in Docker containers created by Wings in github.com/pterodactyl/wings

  GO-2023-1542: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following in github.com/pterodactyl/wings

  GO-2023-1555: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following resulting in deletion of files and directories on the host system in github.com/pterodactyl/wings

  GO-2023-1768: Wings vulnerable to escape to host from installation container in github.com/pterodactyl/wings

  GO-2024-2642: Pterodactyl Wings vulnerable to improper isolation of server file access in github.com/pterodactyl/wings

  GO-2024-2814: Pterodactyl Wings vulnerable to Arbitrary File Write/Read in github.com/pterodactyl/wings

  GO-2024-2815: Pterodactyl Wings vulnerable to Server-Side Request Forgery during remote file pull in github.com/pterodactyl/wings

  GO-2026-4283: Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced in github.com/pterodactyl/wings

  GO-2026-4331: Pterodactyl websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks in github.com/pterodactyl/wings

  GO-2026-4497: Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change in github.com/pterodactyl/wings

  GO-2026-6120: Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions in github.com/pterodactyl/wings

  GO-2026-6156: Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service in github.com/pterodactyl/wings

  GO-2026-6158: Wings exposes node configuration secrets through egg configuration-file templating in github.com/pterodactyl/wings

  GO-2026-6159: Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM in github.com/pterodactyl/wings

Jan 7, 2021 GO-2022-0919 +13 more

  GO-2022-0919: Asymmetric Resource Consumption (Amplification) in Docker containers created by Wings in github.com/pterodactyl/wings

  GO-2023-1542: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following in github.com/pterodactyl/wings

  GO-2023-1555: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following resulting in deletion of files and directories on the host system in github.com/pterodactyl/wings

  GO-2023-1768: Wings vulnerable to escape to host from installation container in github.com/pterodactyl/wings

  GO-2024-2642: Pterodactyl Wings vulnerable to improper isolation of server file access in github.com/pterodactyl/wings

  GO-2024-2814: Pterodactyl Wings vulnerable to Arbitrary File Write/Read in github.com/pterodactyl/wings

  GO-2024-2815: Pterodactyl Wings vulnerable to Server-Side Request Forgery during remote file pull in github.com/pterodactyl/wings

  GO-2026-4283: Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced in github.com/pterodactyl/wings

  GO-2026-4331: Pterodactyl websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks in github.com/pterodactyl/wings

  GO-2026-4497: Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change in github.com/pterodactyl/wings

  GO-2026-6120: Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions in github.com/pterodactyl/wings

  GO-2026-6156: Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service in github.com/pterodactyl/wings

  GO-2026-6158: Wings exposes node configuration secrets through egg configuration-file templating in github.com/pterodactyl/wings

  GO-2026-6159: Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM in github.com/pterodactyl/wings

Dec 31, 2020 GO-2022-0389 +14 more

  GO-2022-0389: Unchecked hostname resolution could allow access to local network resources by users outside the local network in github.com/pterodactyl/wings

  GO-2022-0919: Asymmetric Resource Consumption (Amplification) in Docker containers created by Wings in github.com/pterodactyl/wings

  GO-2023-1542: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following in github.com/pterodactyl/wings

  GO-2023-1555: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following resulting in deletion of files and directories on the host system in github.com/pterodactyl/wings

  GO-2023-1768: Wings vulnerable to escape to host from installation container in github.com/pterodactyl/wings

  GO-2024-2642: Pterodactyl Wings vulnerable to improper isolation of server file access in github.com/pterodactyl/wings

  GO-2024-2814: Pterodactyl Wings vulnerable to Arbitrary File Write/Read in github.com/pterodactyl/wings

  GO-2024-2815: Pterodactyl Wings vulnerable to Server-Side Request Forgery during remote file pull in github.com/pterodactyl/wings

  GO-2026-4283: Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced in github.com/pterodactyl/wings

  GO-2026-4331: Pterodactyl websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks in github.com/pterodactyl/wings

  GO-2026-4497: Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change in github.com/pterodactyl/wings

  GO-2026-6120: Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions in github.com/pterodactyl/wings

  GO-2026-6156: Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service in github.com/pterodactyl/wings

  GO-2026-6158: Wings exposes node configuration secrets through egg configuration-file templating in github.com/pterodactyl/wings

  GO-2026-6159: Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM in github.com/pterodactyl/wings

Changes in this version

+ const TransferLogsEvent

+ const TransferStatusEvent

+ var ErrServerIsInstalling = errors.New("server is currently installing")

+ var ErrServerIsTransferring = errors.New("server is currently being transferred")

type ResourceUsage

+ func (ru *ResourceUsage) Reset()

type Server

+ func New() (*Server, error)

+ func (s *Server) Context() context.Context

+ func (s *Server) CtxCancel()

+ func (s *Server) IsTransferring() bool

+ func (s *Server) SetTransferring(state bool)

Dec 6, 2020 GO-2022-0919 +13 more

  GO-2022-0919: Asymmetric Resource Consumption (Amplification) in Docker containers created by Wings in github.com/pterodactyl/wings

  GO-2023-1542: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following in github.com/pterodactyl/wings

  GO-2023-1555: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following resulting in deletion of files and directories on the host system in github.com/pterodactyl/wings

  GO-2023-1768: Wings vulnerable to escape to host from installation container in github.com/pterodactyl/wings

  GO-2024-2642: Pterodactyl Wings vulnerable to improper isolation of server file access in github.com/pterodactyl/wings

  GO-2024-2814: Pterodactyl Wings vulnerable to Arbitrary File Write/Read in github.com/pterodactyl/wings

  GO-2024-2815: Pterodactyl Wings vulnerable to Server-Side Request Forgery during remote file pull in github.com/pterodactyl/wings

  GO-2026-4283: Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced in github.com/pterodactyl/wings

  GO-2026-4331: Pterodactyl websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks in github.com/pterodactyl/wings

  GO-2026-4497: Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change in github.com/pterodactyl/wings

  GO-2026-6120: Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions in github.com/pterodactyl/wings

  GO-2026-6156: Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service in github.com/pterodactyl/wings

  GO-2026-6158: Wings exposes node configuration secrets through egg configuration-file templating in github.com/pterodactyl/wings

  GO-2026-6159: Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM in github.com/pterodactyl/wings

Nov 15, 2020 GO-2022-0919 +13 more

  GO-2022-0919: Asymmetric Resource Consumption (Amplification) in Docker containers created by Wings in github.com/pterodactyl/wings

  GO-2023-1542: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following in github.com/pterodactyl/wings

  GO-2023-1555: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following resulting in deletion of files and directories on the host system in github.com/pterodactyl/wings

  GO-2023-1768: Wings vulnerable to escape to host from installation container in github.com/pterodactyl/wings

  GO-2024-2642: Pterodactyl Wings vulnerable to improper isolation of server file access in github.com/pterodactyl/wings

  GO-2024-2814: Pterodactyl Wings vulnerable to Arbitrary File Write/Read in github.com/pterodactyl/wings

  GO-2024-2815: Pterodactyl Wings vulnerable to Server-Side Request Forgery during remote file pull in github.com/pterodactyl/wings

  GO-2026-4283: Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced in github.com/pterodactyl/wings

  GO-2026-4331: Pterodactyl websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks in github.com/pterodactyl/wings

  GO-2026-4497: Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change in github.com/pterodactyl/wings

  GO-2026-6120: Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions in github.com/pterodactyl/wings

  GO-2026-6156: Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service in github.com/pterodactyl/wings

  GO-2026-6158: Wings exposes node configuration secrets through egg configuration-file templating in github.com/pterodactyl/wings

  GO-2026-6159: Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM in github.com/pterodactyl/wings

Nov 9, 2020 GO-2022-0919 +13 more

  GO-2022-0919: Asymmetric Resource Consumption (Amplification) in Docker containers created by Wings in github.com/pterodactyl/wings

  GO-2023-1542: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following in github.com/pterodactyl/wings

  GO-2023-1555: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following resulting in deletion of files and directories on the host system in github.com/pterodactyl/wings

  GO-2023-1768: Wings vulnerable to escape to host from installation container in github.com/pterodactyl/wings

  GO-2024-2642: Pterodactyl Wings vulnerable to improper isolation of server file access in github.com/pterodactyl/wings

  GO-2024-2814: Pterodactyl Wings vulnerable to Arbitrary File Write/Read in github.com/pterodactyl/wings

  GO-2024-2815: Pterodactyl Wings vulnerable to Server-Side Request Forgery during remote file pull in github.com/pterodactyl/wings

  GO-2026-4283: Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced in github.com/pterodactyl/wings

  GO-2026-4331: Pterodactyl websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks in github.com/pterodactyl/wings

  GO-2026-4497: Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change in github.com/pterodactyl/wings

  GO-2026-6120: Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions in github.com/pterodactyl/wings

  GO-2026-6156: Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service in github.com/pterodactyl/wings

  GO-2026-6158: Wings exposes node configuration secrets through egg configuration-file templating in github.com/pterodactyl/wings

  GO-2026-6159: Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM in github.com/pterodactyl/wings

Nov 8, 2020 GO-2022-0919 +13 more

  GO-2022-0919: Asymmetric Resource Consumption (Amplification) in Docker containers created by Wings in github.com/pterodactyl/wings

  GO-2023-1542: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following in github.com/pterodactyl/wings

  GO-2023-1555: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following resulting in deletion of files and directories on the host system in github.com/pterodactyl/wings

  GO-2023-1768: Wings vulnerable to escape to host from installation container in github.com/pterodactyl/wings

  GO-2024-2642: Pterodactyl Wings vulnerable to improper isolation of server file access in github.com/pterodactyl/wings

  GO-2024-2814: Pterodactyl Wings vulnerable to Arbitrary File Write/Read in github.com/pterodactyl/wings

  GO-2024-2815: Pterodactyl Wings vulnerable to Server-Side Request Forgery during remote file pull in github.com/pterodactyl/wings

  GO-2026-4283: Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced in github.com/pterodactyl/wings

  GO-2026-4331: Pterodactyl websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks in github.com/pterodactyl/wings

  GO-2026-4497: Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change in github.com/pterodactyl/wings

  GO-2026-6120: Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions in github.com/pterodactyl/wings

  GO-2026-6156: Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service in github.com/pterodactyl/wings

  GO-2026-6158: Wings exposes node configuration secrets through egg configuration-file templating in github.com/pterodactyl/wings

  GO-2026-6159: Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM in github.com/pterodactyl/wings

Changes in this version

type Server

+ func (s *Server) OnStateChange()

Oct 23, 2020 GO-2022-0919 +13 more

  GO-2022-0919: Asymmetric Resource Consumption (Amplification) in Docker containers created by Wings in github.com/pterodactyl/wings

  GO-2023-1542: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following in github.com/pterodactyl/wings

  GO-2023-1555: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following resulting in deletion of files and directories on the host system in github.com/pterodactyl/wings

  GO-2023-1768: Wings vulnerable to escape to host from installation container in github.com/pterodactyl/wings

  GO-2024-2642: Pterodactyl Wings vulnerable to improper isolation of server file access in github.com/pterodactyl/wings

  GO-2024-2814: Pterodactyl Wings vulnerable to Arbitrary File Write/Read in github.com/pterodactyl/wings

  GO-2024-2815: Pterodactyl Wings vulnerable to Server-Side Request Forgery during remote file pull in github.com/pterodactyl/wings

  GO-2026-4283: Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced in github.com/pterodactyl/wings

  GO-2026-4331: Pterodactyl websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks in github.com/pterodactyl/wings

  GO-2026-4497: Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change in github.com/pterodactyl/wings

  GO-2026-6120: Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions in github.com/pterodactyl/wings

  GO-2026-6156: Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service in github.com/pterodactyl/wings

  GO-2026-6158: Wings exposes node configuration secrets through egg configuration-file templating in github.com/pterodactyl/wings

  GO-2026-6159: Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM in github.com/pterodactyl/wings

Oct 11, 2020 GO-2022-0919 +13 more

  GO-2022-0919: Asymmetric Resource Consumption (Amplification) in Docker containers created by Wings in github.com/pterodactyl/wings

  GO-2023-1542: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following in github.com/pterodactyl/wings

  GO-2023-1555: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following resulting in deletion of files and directories on the host system in github.com/pterodactyl/wings

  GO-2023-1768: Wings vulnerable to escape to host from installation container in github.com/pterodactyl/wings

  GO-2024-2642: Pterodactyl Wings vulnerable to improper isolation of server file access in github.com/pterodactyl/wings

  GO-2024-2814: Pterodactyl Wings vulnerable to Arbitrary File Write/Read in github.com/pterodactyl/wings

  GO-2024-2815: Pterodactyl Wings vulnerable to Server-Side Request Forgery during remote file pull in github.com/pterodactyl/wings

  GO-2026-4283: Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced in github.com/pterodactyl/wings

  GO-2026-4331: Pterodactyl websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks in github.com/pterodactyl/wings

  GO-2026-4497: Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change in github.com/pterodactyl/wings

  GO-2026-6120: Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions in github.com/pterodactyl/wings

  GO-2026-6156: Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service in github.com/pterodactyl/wings

  GO-2026-6158: Wings exposes node configuration secrets through egg configuration-file templating in github.com/pterodactyl/wings

  GO-2026-6159: Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM in github.com/pterodactyl/wings

Changes in this version

+ const BackupCompletedEvent

+ const ConsoleOutputEvent

+ const DaemonMessageEvent

+ const InstallCompletedEvent

+ const InstallOutputEvent

+ const InstallStartedEvent

+ const PowerActionRestart

+ const PowerActionStart

+ const PowerActionStop

+ const PowerActionTerminate

+ const StatsEvent

+ const StatusEvent

+ var ErrIsRunning = errors.New("server is running")

+ var ErrSuspended = errors.New("server is currently in a suspended state")

+ var ErrTooMuchConsoleData = errors.New("console is outputting too much data")

+ func CachedServerStates() (map[string]string, error)

+ func IsServerDoesNotExistError(err error) bool

+ func IsTooFrequentCrashError(err error) bool

+ func LoadDirectory() error

+ type Archiver struct

+ Server *Server

+ func (a *Archiver) Archive() error

+ func (a *Archiver) Checksum() (string, error)

+ func (a *Archiver) DeleteIfExists() error

+ func (a *Archiver) Exists() bool

+ func (a *Archiver) Name() string

+ func (a *Archiver) Path() string

+ func (a *Archiver) Stat() (*filesystem.Stat, error)

+ type Collection struct

+ func GetServers() *Collection

+ func NewCollection(servers []*Server) *Collection

+ func (c *Collection) Add(s *Server)

+ func (c *Collection) All() []*Server

+ func (c *Collection) Filter(filter func(*Server) bool) []*Server

+ func (c *Collection) Find(filter func(*Server) bool) *Server

+ func (c *Collection) Remove(filter func(*Server) bool)

+ type Configuration struct

+ Allocations environment.Allocations

+ Build environment.Limits

+ Container struct{ ... }

+ CrashDetectionEnabled bool

+ EnvVars environment.Variables

+ Invocation string

+ Mounts []Mount

+ Resources ResourceUsage

+ SkipEggScripts bool

+ Suspended bool

+ Uuid string

+ func (c *Configuration) GetUuid() string

+ func (c *Configuration) SetSuspended(s bool)

+ type ConsoleThrottler struct

+ func (ct *ConsoleThrottler) Increment(onTrigger func()) error

+ func (ct *ConsoleThrottler) Reset()

+ func (ct *ConsoleThrottler) StartTimer()

+ func (ct *ConsoleThrottler) StopTimer()

+ func (ct *ConsoleThrottler) Throttled() bool

+ type CrashHandler struct

+ func (cd *CrashHandler) LastCrashTime() time.Time

+ func (cd *CrashHandler) SetLastCrash(t time.Time)

+ type IResourceUsage ResourceUsage

+ type InstallationProcess struct

+ Script *api.InstallationScript

+ Server *Server

+ func NewInstallationProcess(s *Server, script *api.InstallationScript) (*InstallationProcess, error)

+ func (ip *InstallationProcess) AfterExecute(containerId string) error

+ func (ip *InstallationProcess) BeforeExecute() error

+ func (ip *InstallationProcess) Execute() (string, error)

+ func (ip *InstallationProcess) GetLogPath() string

+ func (ip *InstallationProcess) RemoveContainer()

+ func (ip *InstallationProcess) Run() error

+ func (ip *InstallationProcess) StreamOutput(id string) error

+ type InstallerDetails struct

+ type Mount environment.Mount

+ type PowerAction string

+ func (pa PowerAction) IsStart() bool

+ func (pa PowerAction) IsValid() bool

+ type ResourceUsage struct

+ Disk int64

+ State string

+ func (ru *ResourceUsage) MarshalJSON() ([]byte, error)

+ func (ru *ResourceUsage) SetDisk(i int64)

+ type Server struct

+ Archiver Archiver

+ Environment environment.ProcessEnvironment

+ func FromConfiguration(data *api.ServerConfigurationResponse) (*Server, error)

+ func (s *Server) AbortInstallation()

+ func (s *Server) Backup(b backup.BackupInterface) error

+ func (s *Server) Config() *Configuration

+ func (s *Server) CreateEnvironment() error

+ func (s *Server) DiskSpace() int64

+ func (s *Server) EnsureDataDirectoryExists() error

+ func (s *Server) Events() *events.EventBus

+ func (s *Server) ExecutingPowerAction() bool

+ func (s *Server) Filesystem() *filesystem.Filesystem

+ func (s *Server) GetEnvironmentVariables() []string

+ func (s *Server) GetIncludedBackupFiles(ignored []string) (*backup.IncludedFiles, error)

+ func (s *Server) GetProcessConfiguration() (*api.ServerConfigurationResponse, *api.RequestError, error)

+ func (s *Server) GetState() string

+ func (s *Server) HandlePowerAction(action PowerAction, waitSeconds ...int) error

+ func (s *Server) Id() string

+ func (s *Server) Install(sync bool) error

+ func (s *Server) IsBootable() bool

+ func (s *Server) IsInstalling() bool

+ func (s *Server) IsRunning() bool

+ func (s *Server) IsSuspended() bool

+ func (s *Server) Log() *log.Entry

+ func (s *Server) MemoryLimit() int64

+ func (s *Server) Mounts() []environment.Mount

+ func (s *Server) Proc() *ResourceUsage

+ func (s *Server) ProcessConfiguration() *api.ProcessConfiguration

+ func (s *Server) PublishConsoleOutputFromDaemon(data string)

+ func (s *Server) ReadLogfile(len int) ([]string, error)

+ func (s *Server) Reinstall() error

+ func (s *Server) SetState(state string) error

+ func (s *Server) StartEventListeners()

+ func (s *Server) Sync() error

+ func (s *Server) SyncInstallState(successful bool) error

+ func (s *Server) SyncWithConfiguration(cfg *api.ServerConfigurationResponse) error

+ func (s *Server) SyncWithEnvironment()

+ func (s *Server) Throttler() *ConsoleThrottler

+ func (s *Server) UpdateConfigurationFiles()

+ func (s *Server) UpdateDataStructure(data []byte) error

+ func (s *Server) Websockets() *WebsocketBag

+ type WebsocketBag struct

+ func (w *WebsocketBag) CancelAll()

+ func (w *WebsocketBag) Push(u uuid.UUID, cancel *context.CancelFunc)

+ func (w *WebsocketBag) Remove(u uuid.UUID)

Oct 4, 2020 GO-2022-0919 +13 more

  GO-2022-0919: Asymmetric Resource Consumption (Amplification) in Docker containers created by Wings in github.com/pterodactyl/wings

  GO-2023-1542: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following in github.com/pterodactyl/wings

  GO-2023-1555: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following resulting in deletion of files and directories on the host system in github.com/pterodactyl/wings

  GO-2023-1768: Wings vulnerable to escape to host from installation container in github.com/pterodactyl/wings

  GO-2024-2642: Pterodactyl Wings vulnerable to improper isolation of server file access in github.com/pterodactyl/wings

  GO-2024-2814: Pterodactyl Wings vulnerable to Arbitrary File Write/Read in github.com/pterodactyl/wings

  GO-2024-2815: Pterodactyl Wings vulnerable to Server-Side Request Forgery during remote file pull in github.com/pterodactyl/wings

  GO-2026-4283: Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced in github.com/pterodactyl/wings

  GO-2026-4331: Pterodactyl websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks in github.com/pterodactyl/wings

  GO-2026-4497: Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change in github.com/pterodactyl/wings

  GO-2026-6120: Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions in github.com/pterodactyl/wings

  GO-2026-6156: Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service in github.com/pterodactyl/wings

  GO-2026-6158: Wings exposes node configuration secrets through egg configuration-file templating in github.com/pterodactyl/wings

  GO-2026-6159: Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM in github.com/pterodactyl/wings

Sep 18, 2020 GO-2022-0919 +13 more

  GO-2022-0919: Asymmetric Resource Consumption (Amplification) in Docker containers created by Wings in github.com/pterodactyl/wings

  GO-2023-1542: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following in github.com/pterodactyl/wings

  GO-2023-1555: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following resulting in deletion of files and directories on the host system in github.com/pterodactyl/wings

  GO-2023-1768: Wings vulnerable to escape to host from installation container in github.com/pterodactyl/wings

  GO-2024-2642: Pterodactyl Wings vulnerable to improper isolation of server file access in github.com/pterodactyl/wings

  GO-2024-2814: Pterodactyl Wings vulnerable to Arbitrary File Write/Read in github.com/pterodactyl/wings

  GO-2024-2815: Pterodactyl Wings vulnerable to Server-Side Request Forgery during remote file pull in github.com/pterodactyl/wings

  GO-2026-4283: Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced in github.com/pterodactyl/wings

  GO-2026-4331: Pterodactyl websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks in github.com/pterodactyl/wings

  GO-2026-4497: Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change in github.com/pterodactyl/wings

  GO-2026-6120: Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions in github.com/pterodactyl/wings

  GO-2026-6156: Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service in github.com/pterodactyl/wings

  GO-2026-6158: Wings exposes node configuration secrets through egg configuration-file templating in github.com/pterodactyl/wings

  GO-2026-6159: Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM in github.com/pterodactyl/wings

Sep 12, 2020 GO-2022-0919 +13 more

  GO-2022-0919: Asymmetric Resource Consumption (Amplification) in Docker containers created by Wings in github.com/pterodactyl/wings

  GO-2023-1542: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following in github.com/pterodactyl/wings

  GO-2023-1555: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following resulting in deletion of files and directories on the host system in github.com/pterodactyl/wings

  GO-2023-1768: Wings vulnerable to escape to host from installation container in github.com/pterodactyl/wings

  GO-2024-2642: Pterodactyl Wings vulnerable to improper isolation of server file access in github.com/pterodactyl/wings

  GO-2024-2814: Pterodactyl Wings vulnerable to Arbitrary File Write/Read in github.com/pterodactyl/wings

  GO-2024-2815: Pterodactyl Wings vulnerable to Server-Side Request Forgery during remote file pull in github.com/pterodactyl/wings

  GO-2026-4283: Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced in github.com/pterodactyl/wings

  GO-2026-4331: Pterodactyl websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks in github.com/pterodactyl/wings

  GO-2026-4497: Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change in github.com/pterodactyl/wings

  GO-2026-6120: Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions in github.com/pterodactyl/wings

  GO-2026-6156: Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service in github.com/pterodactyl/wings

  GO-2026-6158: Wings exposes node configuration secrets through egg configuration-file templating in github.com/pterodactyl/wings

  GO-2026-6159: Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM in github.com/pterodactyl/wings

Sep 11, 2020 GO-2022-0919 +13 more

  GO-2022-0919: Asymmetric Resource Consumption (Amplification) in Docker containers created by Wings in github.com/pterodactyl/wings

  GO-2023-1542: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following in github.com/pterodactyl/wings

  GO-2023-1555: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following resulting in deletion of files and directories on the host system in github.com/pterodactyl/wings

  GO-2023-1768: Wings vulnerable to escape to host from installation container in github.com/pterodactyl/wings

  GO-2024-2642: Pterodactyl Wings vulnerable to improper isolation of server file access in github.com/pterodactyl/wings

  GO-2024-2814: Pterodactyl Wings vulnerable to Arbitrary File Write/Read in github.com/pterodactyl/wings

  GO-2024-2815: Pterodactyl Wings vulnerable to Server-Side Request Forgery during remote file pull in github.com/pterodactyl/wings

  GO-2026-4283: Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced in github.com/pterodactyl/wings

  GO-2026-4331: Pterodactyl websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks in github.com/pterodactyl/wings

  GO-2026-4497: Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change in github.com/pterodactyl/wings

  GO-2026-6120: Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions in github.com/pterodactyl/wings

  GO-2026-6156: Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service in github.com/pterodactyl/wings

  GO-2026-6158: Wings exposes node configuration secrets through egg configuration-file templating in github.com/pterodactyl/wings

  GO-2026-6159: Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM in github.com/pterodactyl/wings

Sep 1, 2020 GO-2022-0919 +13 more

  GO-2022-0919: Asymmetric Resource Consumption (Amplification) in Docker containers created by Wings in github.com/pterodactyl/wings

  GO-2023-1542: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following in github.com/pterodactyl/wings

  GO-2023-1555: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following resulting in deletion of files and directories on the host system in github.com/pterodactyl/wings

  GO-2023-1768: Wings vulnerable to escape to host from installation container in github.com/pterodactyl/wings

  GO-2024-2642: Pterodactyl Wings vulnerable to improper isolation of server file access in github.com/pterodactyl/wings

  GO-2024-2814: Pterodactyl Wings vulnerable to Arbitrary File Write/Read in github.com/pterodactyl/wings

  GO-2024-2815: Pterodactyl Wings vulnerable to Server-Side Request Forgery during remote file pull in github.com/pterodactyl/wings

  GO-2026-4283: Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced in github.com/pterodactyl/wings

  GO-2026-4331: Pterodactyl websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks in github.com/pterodactyl/wings

  GO-2026-4497: Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change in github.com/pterodactyl/wings

  GO-2026-6120: Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions in github.com/pterodactyl/wings

  GO-2026-6156: Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service in github.com/pterodactyl/wings

  GO-2026-6158: Wings exposes node configuration secrets through egg configuration-file templating in github.com/pterodactyl/wings

  GO-2026-6159: Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM in github.com/pterodactyl/wings

Aug 25, 2020 GO-2022-0919 +13 more

  GO-2022-0919: Asymmetric Resource Consumption (Amplification) in Docker containers created by Wings in github.com/pterodactyl/wings

  GO-2023-1542: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following in github.com/pterodactyl/wings

  GO-2023-1555: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following resulting in deletion of files and directories on the host system in github.com/pterodactyl/wings

  GO-2023-1768: Wings vulnerable to escape to host from installation container in github.com/pterodactyl/wings

  GO-2024-2642: Pterodactyl Wings vulnerable to improper isolation of server file access in github.com/pterodactyl/wings

  GO-2024-2814: Pterodactyl Wings vulnerable to Arbitrary File Write/Read in github.com/pterodactyl/wings

  GO-2024-2815: Pterodactyl Wings vulnerable to Server-Side Request Forgery during remote file pull in github.com/pterodactyl/wings

  GO-2026-4283: Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced in github.com/pterodactyl/wings

  GO-2026-4331: Pterodactyl websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks in github.com/pterodactyl/wings

  GO-2026-4497: Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change in github.com/pterodactyl/wings

  GO-2026-6120: Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions in github.com/pterodactyl/wings

  GO-2026-6156: Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service in github.com/pterodactyl/wings

  GO-2026-6158: Wings exposes node configuration secrets through egg configuration-file templating in github.com/pterodactyl/wings

  GO-2026-6159: Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM in github.com/pterodactyl/wings

Aug 24, 2020 GO-2022-0919 +13 more

  GO-2022-0919: Asymmetric Resource Consumption (Amplification) in Docker containers created by Wings in github.com/pterodactyl/wings

  GO-2023-1542: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following in github.com/pterodactyl/wings

  GO-2023-1555: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following resulting in deletion of files and directories on the host system in github.com/pterodactyl/wings

  GO-2023-1768: Wings vulnerable to escape to host from installation container in github.com/pterodactyl/wings

  GO-2024-2642: Pterodactyl Wings vulnerable to improper isolation of server file access in github.com/pterodactyl/wings

  GO-2024-2814: Pterodactyl Wings vulnerable to Arbitrary File Write/Read in github.com/pterodactyl/wings

  GO-2024-2815: Pterodactyl Wings vulnerable to Server-Side Request Forgery during remote file pull in github.com/pterodactyl/wings

  GO-2026-4283: Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced in github.com/pterodactyl/wings

  GO-2026-4331: Pterodactyl websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks in github.com/pterodactyl/wings

  GO-2026-4497: Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change in github.com/pterodactyl/wings

  GO-2026-6120: Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions in github.com/pterodactyl/wings

  GO-2026-6156: Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service in github.com/pterodactyl/wings

  GO-2026-6158: Wings exposes node configuration secrets through egg configuration-file templating in github.com/pterodactyl/wings

  GO-2026-6159: Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM in github.com/pterodactyl/wings

Aug 2, 2020 GO-2022-0919 +13 more

  GO-2022-0919: Asymmetric Resource Consumption (Amplification) in Docker containers created by Wings in github.com/pterodactyl/wings

  GO-2023-1542: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following in github.com/pterodactyl/wings

  GO-2023-1555: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following resulting in deletion of files and directories on the host system in github.com/pterodactyl/wings

  GO-2023-1768: Wings vulnerable to escape to host from installation container in github.com/pterodactyl/wings

  GO-2024-2642: Pterodactyl Wings vulnerable to improper isolation of server file access in github.com/pterodactyl/wings

  GO-2024-2814: Pterodactyl Wings vulnerable to Arbitrary File Write/Read in github.com/pterodactyl/wings

  GO-2024-2815: Pterodactyl Wings vulnerable to Server-Side Request Forgery during remote file pull in github.com/pterodactyl/wings

  GO-2026-4283: Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced in github.com/pterodactyl/wings

  GO-2026-4331: Pterodactyl websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks in github.com/pterodactyl/wings

  GO-2026-4497: Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change in github.com/pterodactyl/wings

  GO-2026-6120: Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions in github.com/pterodactyl/wings

  GO-2026-6156: Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service in github.com/pterodactyl/wings

  GO-2026-6158: Wings exposes node configuration secrets through egg configuration-file templating in github.com/pterodactyl/wings

  GO-2026-6159: Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM in github.com/pterodactyl/wings

Jul 20, 2020 GO-2022-0919 +13 more

  GO-2022-0919: Asymmetric Resource Consumption (Amplification) in Docker containers created by Wings in github.com/pterodactyl/wings

  GO-2023-1542: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following in github.com/pterodactyl/wings

  GO-2023-1555: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following resulting in deletion of files and directories on the host system in github.com/pterodactyl/wings

  GO-2023-1768: Wings vulnerable to escape to host from installation container in github.com/pterodactyl/wings

  GO-2024-2642: Pterodactyl Wings vulnerable to improper isolation of server file access in github.com/pterodactyl/wings

  GO-2024-2814: Pterodactyl Wings vulnerable to Arbitrary File Write/Read in github.com/pterodactyl/wings

  GO-2024-2815: Pterodactyl Wings vulnerable to Server-Side Request Forgery during remote file pull in github.com/pterodactyl/wings

  GO-2026-4283: Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced in github.com/pterodactyl/wings

  GO-2026-4331: Pterodactyl websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks in github.com/pterodactyl/wings

  GO-2026-4497: Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change in github.com/pterodactyl/wings

  GO-2026-6120: Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions in github.com/pterodactyl/wings

  GO-2026-6156: Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service in github.com/pterodactyl/wings

  GO-2026-6158: Wings exposes node configuration secrets through egg configuration-file templating in github.com/pterodactyl/wings

  GO-2026-6159: Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM in github.com/pterodactyl/wings

Jun 30, 2020 GO-2022-0919 +13 more

  GO-2022-0919: Asymmetric Resource Consumption (Amplification) in Docker containers created by Wings in github.com/pterodactyl/wings

  GO-2023-1542: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following in github.com/pterodactyl/wings

  GO-2023-1555: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following resulting in deletion of files and directories on the host system in github.com/pterodactyl/wings

  GO-2023-1768: Wings vulnerable to escape to host from installation container in github.com/pterodactyl/wings

  GO-2024-2642: Pterodactyl Wings vulnerable to improper isolation of server file access in github.com/pterodactyl/wings

  GO-2024-2814: Pterodactyl Wings vulnerable to Arbitrary File Write/Read in github.com/pterodactyl/wings

  GO-2024-2815: Pterodactyl Wings vulnerable to Server-Side Request Forgery during remote file pull in github.com/pterodactyl/wings

  GO-2026-4283: Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced in github.com/pterodactyl/wings

  GO-2026-4331: Pterodactyl websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks in github.com/pterodactyl/wings

  GO-2026-4497: Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change in github.com/pterodactyl/wings

  GO-2026-6120: Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions in github.com/pterodactyl/wings

  GO-2026-6156: Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service in github.com/pterodactyl/wings

  GO-2026-6158: Wings exposes node configuration secrets through egg configuration-file templating in github.com/pterodactyl/wings

  GO-2026-6159: Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM in github.com/pterodactyl/wings

Jun 19, 2020 GO-2022-0919 +13 more

  GO-2022-0919: Asymmetric Resource Consumption (Amplification) in Docker containers created by Wings in github.com/pterodactyl/wings

  GO-2023-1542: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following in github.com/pterodactyl/wings

  GO-2023-1555: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following resulting in deletion of files and directories on the host system in github.com/pterodactyl/wings

  GO-2023-1768: Wings vulnerable to escape to host from installation container in github.com/pterodactyl/wings

  GO-2024-2642: Pterodactyl Wings vulnerable to improper isolation of server file access in github.com/pterodactyl/wings

  GO-2024-2814: Pterodactyl Wings vulnerable to Arbitrary File Write/Read in github.com/pterodactyl/wings

  GO-2024-2815: Pterodactyl Wings vulnerable to Server-Side Request Forgery during remote file pull in github.com/pterodactyl/wings

  GO-2026-4283: Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced in github.com/pterodactyl/wings

  GO-2026-4331: Pterodactyl websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks in github.com/pterodactyl/wings

  GO-2026-4497: Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change in github.com/pterodactyl/wings

  GO-2026-6120: Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions in github.com/pterodactyl/wings

  GO-2026-6156: Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service in github.com/pterodactyl/wings

  GO-2026-6158: Wings exposes node configuration secrets through egg configuration-file templating in github.com/pterodactyl/wings

  GO-2026-6159: Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM in github.com/pterodactyl/wings

May 18, 2020 GO-2022-0919 +13 more

  GO-2022-0919: Asymmetric Resource Consumption (Amplification) in Docker containers created by Wings in github.com/pterodactyl/wings

  GO-2023-1542: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following in github.com/pterodactyl/wings

  GO-2023-1555: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following resulting in deletion of files and directories on the host system in github.com/pterodactyl/wings

  GO-2023-1768: Wings vulnerable to escape to host from installation container in github.com/pterodactyl/wings

  GO-2024-2642: Pterodactyl Wings vulnerable to improper isolation of server file access in github.com/pterodactyl/wings

  GO-2024-2814: Pterodactyl Wings vulnerable to Arbitrary File Write/Read in github.com/pterodactyl/wings

  GO-2024-2815: Pterodactyl Wings vulnerable to Server-Side Request Forgery during remote file pull in github.com/pterodactyl/wings

  GO-2026-4283: Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced in github.com/pterodactyl/wings

  GO-2026-4331: Pterodactyl websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks in github.com/pterodactyl/wings

  GO-2026-4497: Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change in github.com/pterodactyl/wings

  GO-2026-6120: Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions in github.com/pterodactyl/wings

  GO-2026-6156: Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service in github.com/pterodactyl/wings

  GO-2026-6158: Wings exposes node configuration secrets through egg configuration-file templating in github.com/pterodactyl/wings

  GO-2026-6159: Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM in github.com/pterodactyl/wings

May 9, 2020 GO-2022-0919 +13 more

  GO-2022-0919: Asymmetric Resource Consumption (Amplification) in Docker containers created by Wings in github.com/pterodactyl/wings

  GO-2023-1542: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following in github.com/pterodactyl/wings

  GO-2023-1555: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following resulting in deletion of files and directories on the host system in github.com/pterodactyl/wings

  GO-2023-1768: Wings vulnerable to escape to host from installation container in github.com/pterodactyl/wings

  GO-2024-2642: Pterodactyl Wings vulnerable to improper isolation of server file access in github.com/pterodactyl/wings

  GO-2024-2814: Pterodactyl Wings vulnerable to Arbitrary File Write/Read in github.com/pterodactyl/wings

  GO-2024-2815: Pterodactyl Wings vulnerable to Server-Side Request Forgery during remote file pull in github.com/pterodactyl/wings

  GO-2026-4283: Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced in github.com/pterodactyl/wings

  GO-2026-4331: Pterodactyl websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks in github.com/pterodactyl/wings

  GO-2026-4497: Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change in github.com/pterodactyl/wings

  GO-2026-6120: Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions in github.com/pterodactyl/wings

  GO-2026-6156: Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service in github.com/pterodactyl/wings

  GO-2026-6158: Wings exposes node configuration secrets through egg configuration-file templating in github.com/pterodactyl/wings

  GO-2026-6159: Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM in github.com/pterodactyl/wings

May 4, 2020 GO-2022-0919 +13 more

  GO-2022-0919: Asymmetric Resource Consumption (Amplification) in Docker containers created by Wings in github.com/pterodactyl/wings

  GO-2023-1542: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following in github.com/pterodactyl/wings

  GO-2023-1555: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following resulting in deletion of files and directories on the host system in github.com/pterodactyl/wings

  GO-2023-1768: Wings vulnerable to escape to host from installation container in github.com/pterodactyl/wings

  GO-2024-2642: Pterodactyl Wings vulnerable to improper isolation of server file access in github.com/pterodactyl/wings

  GO-2024-2814: Pterodactyl Wings vulnerable to Arbitrary File Write/Read in github.com/pterodactyl/wings

  GO-2024-2815: Pterodactyl Wings vulnerable to Server-Side Request Forgery during remote file pull in github.com/pterodactyl/wings

  GO-2026-4283: Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced in github.com/pterodactyl/wings

  GO-2026-4331: Pterodactyl websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks in github.com/pterodactyl/wings

  GO-2026-4497: Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change in github.com/pterodactyl/wings

  GO-2026-6120: Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions in github.com/pterodactyl/wings

  GO-2026-6156: Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service in github.com/pterodactyl/wings

  GO-2026-6158: Wings exposes node configuration secrets through egg configuration-file templating in github.com/pterodactyl/wings

  GO-2026-6159: Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM in github.com/pterodactyl/wings

Apr 26, 2020 GO-2022-0919 +13 more

  GO-2022-0919: Asymmetric Resource Consumption (Amplification) in Docker containers created by Wings in github.com/pterodactyl/wings

  GO-2023-1542: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following in github.com/pterodactyl/wings

  GO-2023-1555: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following resulting in deletion of files and directories on the host system in github.com/pterodactyl/wings

  GO-2023-1768: Wings vulnerable to escape to host from installation container in github.com/pterodactyl/wings

  GO-2024-2642: Pterodactyl Wings vulnerable to improper isolation of server file access in github.com/pterodactyl/wings

  GO-2024-2814: Pterodactyl Wings vulnerable to Arbitrary File Write/Read in github.com/pterodactyl/wings

  GO-2024-2815: Pterodactyl Wings vulnerable to Server-Side Request Forgery during remote file pull in github.com/pterodactyl/wings

  GO-2026-4283: Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced in github.com/pterodactyl/wings

  GO-2026-4331: Pterodactyl websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks in github.com/pterodactyl/wings

  GO-2026-4497: Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change in github.com/pterodactyl/wings

  GO-2026-6120: Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions in github.com/pterodactyl/wings

  GO-2026-6156: Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service in github.com/pterodactyl/wings

  GO-2026-6158: Wings exposes node configuration secrets through egg configuration-file templating in github.com/pterodactyl/wings

  GO-2026-6159: Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM in github.com/pterodactyl/wings

Apr 13, 2020 GO-2022-0919 +13 more

  GO-2022-0919: Asymmetric Resource Consumption (Amplification) in Docker containers created by Wings in github.com/pterodactyl/wings

  GO-2023-1542: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following in github.com/pterodactyl/wings

  GO-2023-1555: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following resulting in deletion of files and directories on the host system in github.com/pterodactyl/wings

  GO-2023-1768: Wings vulnerable to escape to host from installation container in github.com/pterodactyl/wings

  GO-2024-2642: Pterodactyl Wings vulnerable to improper isolation of server file access in github.com/pterodactyl/wings

  GO-2024-2814: Pterodactyl Wings vulnerable to Arbitrary File Write/Read in github.com/pterodactyl/wings

  GO-2024-2815: Pterodactyl Wings vulnerable to Server-Side Request Forgery during remote file pull in github.com/pterodactyl/wings

  GO-2026-4283: Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced in github.com/pterodactyl/wings

  GO-2026-4331: Pterodactyl websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks in github.com/pterodactyl/wings

  GO-2026-4497: Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change in github.com/pterodactyl/wings

  GO-2026-6120: Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions in github.com/pterodactyl/wings

  GO-2026-6156: Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service in github.com/pterodactyl/wings

  GO-2026-6158: Wings exposes node configuration secrets through egg configuration-file templating in github.com/pterodactyl/wings

  GO-2026-6159: Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM in github.com/pterodactyl/wings

Jan 19, 2020 GO-2022-0919 +13 more

  GO-2022-0919: Asymmetric Resource Consumption (Amplification) in Docker containers created by Wings in github.com/pterodactyl/wings

  GO-2023-1542: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following in github.com/pterodactyl/wings

  GO-2023-1555: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following resulting in deletion of files and directories on the host system in github.com/pterodactyl/wings

  GO-2023-1768: Wings vulnerable to escape to host from installation container in github.com/pterodactyl/wings

  GO-2024-2642: Pterodactyl Wings vulnerable to improper isolation of server file access in github.com/pterodactyl/wings

  GO-2024-2814: Pterodactyl Wings vulnerable to Arbitrary File Write/Read in github.com/pterodactyl/wings

  GO-2024-2815: Pterodactyl Wings vulnerable to Server-Side Request Forgery during remote file pull in github.com/pterodactyl/wings

  GO-2026-4283: Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced in github.com/pterodactyl/wings

  GO-2026-4331: Pterodactyl websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks in github.com/pterodactyl/wings

  GO-2026-4497: Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change in github.com/pterodactyl/wings

  GO-2026-6120: Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions in github.com/pterodactyl/wings

  GO-2026-6156: Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service in github.com/pterodactyl/wings

  GO-2026-6158: Wings exposes node configuration secrets through egg configuration-file templating in github.com/pterodactyl/wings

  GO-2026-6159: Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM in github.com/pterodactyl/wings

Dec 23, 2019 GO-2022-0919 +13 more

  GO-2022-0919: Asymmetric Resource Consumption (Amplification) in Docker containers created by Wings in github.com/pterodactyl/wings

  GO-2023-1542: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following in github.com/pterodactyl/wings

  GO-2023-1555: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following resulting in deletion of files and directories on the host system in github.com/pterodactyl/wings

  GO-2023-1768: Wings vulnerable to escape to host from installation container in github.com/pterodactyl/wings

  GO-2024-2642: Pterodactyl Wings vulnerable to improper isolation of server file access in github.com/pterodactyl/wings

  GO-2024-2814: Pterodactyl Wings vulnerable to Arbitrary File Write/Read in github.com/pterodactyl/wings

  GO-2024-2815: Pterodactyl Wings vulnerable to Server-Side Request Forgery during remote file pull in github.com/pterodactyl/wings

  GO-2026-4283: Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced in github.com/pterodactyl/wings

  GO-2026-4331: Pterodactyl websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks in github.com/pterodactyl/wings

  GO-2026-4497: Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change in github.com/pterodactyl/wings

  GO-2026-6120: Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions in github.com/pterodactyl/wings

  GO-2026-6156: Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service in github.com/pterodactyl/wings

  GO-2026-6158: Wings exposes node configuration secrets through egg configuration-file templating in github.com/pterodactyl/wings

  GO-2026-6159: Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM in github.com/pterodactyl/wings