PT-2026-65514 · Unknown · Pterodactyl Wings+1

CVE-2026-54593 · Published 2026-07-28 · Updated 2026-07-28

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Pterodactyl Panel versions prior to 1.12.3 Pterodactyl Wings versions prior to 1.12.2

Description A privilege escalation issue exists in the Wings '/upload/file' endpoint. The system accepts any valid panel-signed JSON Web Token (JWT) containing server uuid, user uuid, and unique id claims without verifying the token's intended purpose. Since the Panel issues JWTs with these same claims for lower-privilege operations, such as WebSocket authentication and file-download links, an authenticated subuser can reuse a token obtained for a limited action (e.g., using the websocket.connect permission) to write arbitrary files to the server, bypassing the requirement for the file.create permission.

Recommendations Update Pterodactyl Panel to version 1.12.3 or later. Update Pterodactyl Wings to version 1.12.2 or later.

Fix

Weakness Enumeration

CWE-1259

CWE-1270

Related Identifiers

CVE-2026-54593

GHSA-8R6W-3QQ5-4P4R

Affected Products

Pterodactyl Panel

Pterodactyl Wings

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-54593 · Security Note
• https://osv.dev/vulnerability/GHSA-8r6w-3qq5-4p4r · Vendor Advisory
• https://github.com/pterodactyl/panel/security/advisories/GHSA-8r6w-3qq5-4p4r · Note
• https://github.com/pterodactyl/panel/pull/5636 · Note
• https://github.com/pterodactyl/panel/commit/7ffcd636310bb72b54bac3280d2a15e727feded7 · Note
• https://github.com/pterodactyl/panel · Note
• https://github.com/pterodactyl/wings/commit/d0ddc80844479302abdaf9654de3bacd511c0f5c · Note