CVE-2023-25168: Pterodactyl Wings UNIX Symbolic Link (Symlink) Following Vulnerability
Summary
CVE-2023-25168: Impact This vulnerability impacts anyone running the affected versions of Wings. Affects github.com/pterodactyl/wings across 2 version ranges.
< 1.7.4
>= 1.11.0, < 1.11.4
Fixed in 1.7.4 or 1.11.4, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pterodactyl Wings is a Go package that provides server management functionality. It is used to allocate and control servers, allowing users to manage files and directories on the host system. However, certain versions of Wings are vulnerable to a UNIX Symbolic Link (Symlink) Following vulnerability.
Vulnerability Detail
The vulnerability allows an attacker with an existing 'server' allocated and controlled by Wings to delete files and directories recursively on the host system. This can be combined with another vulnerability (GHSA-p8r3-83r8-jwj5) to overwrite files on the host system. The exploitation details of this vulnerability will be released on February 24th, 2023 in North America.
How To Fix
Latest published version: v1.13.4 as of 22 Oct 2026
go get github.com/pterodactyl/wings@v1.13.4Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.7.41.7.4go get github.com/pterodactyl/wings@v1.7.4 -
>= 1.11.0, < 1.11.41.11.4go get github.com/pterodactyl/wings@v1.11.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
No workarounds are currently available for this vulnerability.
Conclusion
The Pterodactyl Wings UNIX Symbolic Link (Symlink) Following vulnerability can lead to the deletion of files and directories on the host system. It is crucial to upgrade to the patched versions (1.11.4 or 1.7.4) to mitigate the risk. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/pterodactyl/wings →
FAQ
Anyone running the affected versions of Wings is vulnerable to this exploit.
An attacker can delete files and directories recursively on the host system, potentially causing data loss or disruption.
Yes, this vulnerability can be combined with another vulnerability to overwrite files on the host system.
Yes, the vulnerability has been resolved in versions 1.11.4 and 1.7.4 of Wings.
You can refer to the official advisory on the GitHub Advisory Database for detailed information.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/pterodactyl/wings.
