CVE-2023-25152: UNIX Symbolic Link (Symlink) Following in Pterodactyl Wings
Summary
CVE-2023-25152: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following in github.com/pterodactyl/wings. Affects github.com/pterodactyl/wings across 2 version ranges.
< 1.7.3
>= 1.11.0, < 1.11.3
Fixed in 1.7.3 or 1.11.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pterodactyl Wings is a Go package that provides functionality for managing game servers. It is widely used in the gaming industry to streamline server management tasks. However, a vulnerability has been discovered in the package that allows for UNIX Symbolic Link (Symlink) Following.
Vulnerability Detail
The vulnerability in Pterodactyl Wings allows an attacker to exploit symbolic links to access files or directories outside the intended scope. This can lead to unauthorized access, data leakage, or even remote code execution. The vulnerability affects versions 0 through 1.7.3 and 1.11.0 through 1.11.3 of the package.
How To Fix
Latest published version: v1.13.4 as of 22 Oct 2026
go get github.com/pterodactyl/wings@v1.13.4Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.7.31.7.3go get github.com/pterodactyl/wings@v1.7.3 -
>= 1.11.0, < 1.11.31.11.3go get github.com/pterodactyl/wings@v1.11.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update to the fixed version as soon as possible.
Conclusion
Pterodactyl Wings, a popular Go package for game server management, is vulnerable to UNIX Symbolic Link (Symlink) Following. This vulnerability can result in unauthorized access, data leakage, or remote code execution. It is crucial to update to version 1.11.3 or higher to mitigate the risk.
See every vulnerability recorded for github.com/pterodactyl/wings →
FAQ
Pterodactyl Wings is a Go package used for managing game servers. It provides a range of functionalities to simplify server management tasks.
UNIX Symbolic Link (Symlink) Following is a technique that allows a symbolic link to be followed to its target file or directory. In the context of this vulnerability, it can be exploited to access files or directories outside the intended scope.
This vulnerability can lead to unauthorized access, data leakage, or remote code execution. Attackers can exploit the symlink following to access sensitive files or execute arbitrary code on the affected system.
Versions 0 through 1.7.3 and 1.11.0 through 1.11.3 of Pterodactyl Wings are affected by this vulnerability.
To fix the vulnerability, update Pterodactyl Wings to version 1.11.3 or higher. Ensure that you are using the latest version of the package in your application.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/pterodactyl/wings.
