CVE-2023-32080: Wings vulnerable to escape to host from installation container in github.com/pterodactyl/wings
Summary
CVE-2023-32080: Wings vulnerable to escape to host from installation container in github.com/pterodactyl/wings. Affects github.com/pterodactyl/wings across 2 version ranges.
< 1.7.5
>= 1.11.0, < 1.11.6
Fixed in 1.7.5 or 1.11.6, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is github.com/pterodactyl/wings, which is written in Go. Wings is a software that provides a control panel for managing game servers. It allows users to easily manage and monitor their game servers through a web interface. However, a vulnerability has been discovered in Wings that allows an attacker to escape from the installation container and gain access to the host system.
Vulnerability Detail
The vulnerability in Wings allows an attacker to escape from the installation container and gain access to the host system. This can lead to unauthorized access, privilege escalation, and potential compromise of the entire host system. The vulnerability originates from a flaw in the containerization implementation of Wings, which fails to properly isolate the container environment from the host system. By exploiting this vulnerability, an attacker can execute arbitrary commands on the host system and potentially take control of it.
How To Fix
Latest published version: v1.13.4 as of 22 Oct 2026
go get github.com/pterodactyl/wings@v1.13.4Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.7.51.7.5go get github.com/pterodactyl/wings@v1.7.5 -
>= 1.11.0, < 1.11.61.11.6go get github.com/pterodactyl/wings@v1.11.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the fixed version of Wings to ensure the security of the system.
Conclusion
The vulnerability in Wings allows an attacker to escape from the installation container and gain unauthorized access to the host system. It is crucial to update to the fixed version of Wings to mitigate the risk of exploitation. Failure to do so may result in unauthorized access, privilege escalation, and compromise of the entire host system.
See every vulnerability recorded for github.com/pterodactyl/wings →
FAQ
Wings is a software that provides a control panel for managing game servers.
The vulnerability allows an attacker to escape from the installation container and gain access to the host system, potentially leading to unauthorized access, privilege escalation, and compromise of the entire host system.
To fix this vulnerability, update to Wings version 1.7.5 or later.
No, there is no known workaround. Updating to the fixed version is necessary.
You can find more information about this vulnerability in the vulnerability report at https://pkg.go.dev/vuln/GO-2023-1768.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/pterodactyl/wings.
