CVE-2023-25152: Pterodactyl Wings UNIX Symbolic Link (Symlink) Following Vulnerability
Summary
CVE-2023-25168: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following resulting in deletion of files and directories on the host system in github.com/pterodactyl/wings. Affects github.com/pterodactyl/wings across 2 version ranges.
< 1.7.4
>= 1.11.0, < 1.11.4
Fixed in 1.7.4 or 1.11.4, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pterodactyl Wings is a Go package that provides a web-based control panel for managing game servers. It is commonly used by server administrators to easily manage and monitor their game servers. However, a vulnerability has been discovered in Pterodactyl Wings that allows an attacker to exploit UNIX Symbolic Link (Symlink) Following, leading to the deletion of files and directories on the host system. This vulnerability can have severe consequences, potentially resulting in data loss or unauthorized access to sensitive information.
Vulnerability Detail
The vulnerability in Pterodactyl Wings arises from its improper handling of UNIX Symbolic Links (Symlinks). By manipulating symlinks, an attacker can trick the application into deleting files and directories on the host system. This can be achieved by creating a malicious symlink that points to a critical file or directory, causing the application to unintentionally delete it. The impact of this vulnerability can be devastating, as it allows an attacker to delete important system files or user data, leading to service disruption or unauthorized access.
How To Fix
Latest published version: v1.13.4 as of 22 Oct 2026
go get github.com/pterodactyl/wings@v1.13.4Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.7.41.7.4go get github.com/pterodactyl/wings@v1.7.4 -
>= 1.11.0, < 1.11.41.11.4go get github.com/pterodactyl/wings@v1.11.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update to the latest version of Pterodactyl Wings to mitigate the risk of exploitation.
Conclusion
The vulnerability in Pterodactyl Wings allows an attacker to exploit UNIX Symbolic Link (Symlink) Following, resulting in the deletion of files and directories on the host system. To mitigate this risk, it is crucial to update Pterodactyl Wings to version 1.7.4 or later. Failure to do so may lead to data loss, service disruption, or unauthorized access. Stay informed about the latest security updates and follow best practices to ensure the security of your systems.
See every vulnerability recorded for github.com/pterodactyl/wings →
FAQ
Pterodactyl Wings is a Go package that provides a web-based control panel for managing game servers.
The vulnerability allows an attacker to delete files and directories on the host system, potentially leading to data loss or unauthorized access.
To fix this vulnerability, update Pterodactyl Wings to version 1.7.4 or later.
No, there is no known workaround. Updating to the latest version is the recommended solution.
You can find more information about this vulnerability in the vulnerability report provided by the package maintainers.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/pterodactyl/wings.
