CVE-2023-25152: Pterodactyl Wings UNIX Symbolic Link (Symlink) Following
Summary
CVE-2023-25152: Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following. Affects github.com/pterodactyl/wings across 2 version ranges.
< 1.7.3
>= 1.11.0, < 1.11.3
Fixed in 1.7.3 or 1.11.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Pterodactyl Wings is a Go package that provides resource allocation and management for servers. It is commonly used to control and allocate server resources in containerized environments. However, certain versions of Wings are vulnerable to a UNIX Symbolic Link (Symlink) Following vulnerability.
Vulnerability Detail
The vulnerability allows attackers with an existing 'server' allocated and controlled by Wings to create new files on the host system. This can potentially lead to unauthorized changes in resource allocations, promotion of containers to privileged mode, or the addition of SSH authorized keys for remote shell access. The exploitation details will be released on February 24th, 2023 in North America.
How To Fix
Latest published version: v1.13.4 as of 22 Oct 2026
go get github.com/pterodactyl/wings@v1.13.4Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.7.31.7.3go get github.com/pterodactyl/wings@v1.7.3 -
>= 1.11.0, < 1.11.31.11.3go get github.com/pterodactyl/wings@v1.11.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
No workarounds are currently available for this vulnerability.
Conclusion
The Pterodactyl Wings package is vulnerable to a UNIX Symbolic Link (Symlink) Following vulnerability. It is crucial to upgrade to the patched versions (v1.11.3 or v1.7.3) to mitigate the risk. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for github.com/pterodactyl/wings →
FAQ
The vulnerability allows attackers to create new files on the host system, potentially leading to unauthorized changes in resource allocations, promotion of containers to privileged mode, or the addition of SSH authorized keys for remote shell access.
Anyone running the affected versions of Pterodactyl Wings is vulnerable to this exploit.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your Gopkg.lock file to the playground and it will alert you in real-time if your application is vulnerable.
No, there are currently no known workarounds for this vulnerability.
You can find more information about this vulnerability in the advisory published by GitHub at the following link: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/02/GHSA-p8r3-83r8-jwj5/GHSA-p8r3-83r8-jwj5.json
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/pterodactyl/wings.
