CVE-2026-61617
HighCVSS 7.7Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
Wings (the server control plane for Pterodactyl) versions up to and including 1.13.2 do not enforce a server's disk quota during an SFTP transfer, allowing a tenant with SFTP write access to exhaust the host node's physical disk and take down every server on it. Available space is checked only once, when the write handle is opened, using a stale cached value and without knowing the size of the incoming data.
Risk Assessment
Risk of DoS attack on the entire node, potentially leading to unavailability of all servers on it.
Recommendation
Upgrade Wings to version 1.13.3 or later, which includes the fix.
Other vulnerabilities in Wings
See all- CVE-2026-52857Medium
Wings, the server control plane for Pterodactyl, prior to version 1.13.0 has unbounded JSON, YAML, and XML configuration file parsers. They can process an oversized configuration file and exhaust Wings process memory.
- CVE-2026-52855Critical
Wings, the server control plane for Pterodactyl, prior to 1.12.3 allows a low-privileged user to read sensitive configuration data (token, token_id, Docker registries) via {{config.}} placeholders in egg configuration-file templates.
- CVE-2026-52856High
Wings, the server control plane for Pterodactyl, prior to version 1.13.0 contains a vulnerability causing a Go panic due to a malformed packet received during the SFTP connection handshake. This issue is fixed in version 1.13.0.
Original NVD description (English source)
Wings is the server control plane for the Pterodactyl game-server management panel. In versions up to and including 1.13.2, the SFTP write path does not enforce a server's disk quota during a transfer, allowing a tenant with SFTP write access to a single server to exhaust the host node's physical disk and take down every server on it. Wings checks available space only once, as a boolean, when the write handle is opened, using a stale cached usage value and without knowing the size of the incoming data, and it then returns a raw, unaccounted file handle that is never re-checked as the transfer proceeds. A single upload can therefore be written without bound, far beyond the configured disk limit, until the node's disk is full, and because a server stopped for exceeding its limit is not treated as suspended, SFTP writes are still accepted even after the quota is already exceeded. This issue is fixed in version 1.13.3.