Loading...
Skip to main content
GeekWala

CVE-2023-25168 — Vulnerability in github.com/pterodactyl/wings —...

CRITICAL

Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following resulting in deletion of files and directories on the host system

Published February 10, 2023Updated February 4, 2026Source: osv

Summary

### Impact This vulnerability impacts anyone running the affected versions of Wings. The vulnerability can be used to delete files and directories recursively on the host system. This vulnerability can be combined with [`GHSA-p8r3-83r8-jwj5`](https://github.com/pterodactyl/wings/security/advisories/GHSA-p8r3-83r8-jwj5) to overwrite files on the host system. In order to use this exploit, an attacker must have an existing "server" allocated and controlled by Wings. Information on how the exploitation of this vulnerability works will be released on February 24th, 2023 in North America. ### Patches This vulnerability has been resolved in version `v1.11.4` of Wings, and has been back-ported to the 1.7 release series in `v1.7.4`. Anyone running `v1.11.x` should upgrade to `v1.11.4` and anyone running `v1.7.x` should upgrade to `v1.7.4`. ### Workarounds None at this time.

Advisory Timeline

  • First published February 10, 2023 (1340 days ago).
  • Last revised February 4, 2026 — 1089 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Go
Update github.com/pterodactyl/wings to 1.7.4 or later
go get github.com/pterodactyl/wings@v1.7.4
Go
Update github.com/pterodactyl/wings to 1.11.4 or later
go get github.com/pterodactyl/wings@v1.11.4

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (2)

Affects 1 ecosystem: go (1).

PackageEcosystemAffectedFixed In
github.com/pterodactyl/wings
go
All versions1.7.4
github.com/pterodactyl/wings
go
All versions1.11.4

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.6 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
None
Integrity
High
Availability
High

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H

References

Frequently Asked Questions

What is CVE-2023-25168?
Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following resulting in deletion of files and directories on the host system This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.6/10).
How do I check if my project is affected by CVE-2023-25168?
CVE-2023-25168 affects github.com/pterodactyl/wings. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2023-25168 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
9.6

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

GHSA-66p8-j459-rq63
GO-2023-1555

Related CVEs

  • CVE-2024-27102
    CRITICAL

    Pterodactyl Wings vulnerable to improper isolation of server file access

  • CVE-2026-107806
    CRITICAL

    Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite

  • CVE-2026-52855
    CRITICAL

    Wings exposes node configuration secrets through egg configuration-file templating

  • CVE-2026-68582
    CRITICAL

    Vikunja: Link-share token reads any tenant's kanban buckets and enumerates usernames/IDs instance-wide (BOLA)

  • CVE-2026-54593
    HIGH

    Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions

More Go Modules advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies