CVE-2024-27102: Pterodactyl Wings Improper Isolation of Server File Access
Summary
CVE-2024-27102: Pterodactyl Wings vulnerable to improper isolation of server file access in github.com/pterodactyl/wings. Affects github.com/pterodactyl/wings versions < 1.11.9. Fixed in 1.11.9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pterodactyl Wings is a Go package developed by github.com/pterodactyl/wings. It is a server management software that provides a user-friendly interface for managing game servers. The package allows users to easily control and monitor their game servers, perform administrative tasks, and manage server files. However, a vulnerability has been identified in the package that leads to improper isolation of server file access.
Vulnerability Detail
The vulnerability in Pterodactyl Wings arises from the improper isolation of server file access. This means that an attacker can potentially gain unauthorized access to sensitive server files, modify them, or even delete them. This can result in a variety of security issues, including data breaches, unauthorized code execution, and disruption of server operations. The vulnerability affects versions 0 to 1.11.8 of the package.
How To Fix
Latest published version: v1.13.4 as of 22 Oct 2026
go get github.com/pterodactyl/wings@v1.13.4Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.11.9
This is the first release that contains the fix.
go get github.com/pterodactyl/wings@v1.11.9Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can implement additional access controls and permissions to restrict file access within the server environment. This can involve setting proper file permissions, implementing user authentication and authorization mechanisms, and regularly monitoring server logs for any suspicious activity. However, it is important to note that these workarounds may not provide complete protection and should be considered temporary measures until the package is updated.
Conclusion
In conclusion, Pterodactyl Wings is vulnerable to improper isolation of server file access, which can lead to unauthorized access and manipulation of server files. It is crucial to update the package to version 1.11.9 or later to mitigate this vulnerability. Implementing additional access controls and permissions can serve as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/pterodactyl/wings →
FAQ
Pterodactyl Wings is a Go package that provides server management capabilities for game servers.
The vulnerability allows unauthorized access to server files, potentially leading to data breaches and disruption of server operations.
Versions 0 to 1.11.8 of Pterodactyl Wings are affected by this vulnerability.
To fix this vulnerability, update Pterodactyl Wings to version 1.11.9 or later.
As a temporary workaround, implement additional access controls and permissions within the server environment.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/pterodactyl/wings.
