Vulnerability record · CVE-2024-34066 · published 3 May 2024

CVE-2024-34066: Pterodactyl wings vulnerability

Pterodactyl · Wings

Pterodactyl wings is the server control plane for Pterodactyl Panel. If the Wings token is leaked either by viewing the node configuration or posting it accidentally somewhere, an attacker can use it to gain arbitrary file write and read access on the node the token is associated to. This issue has been addressed in version 1.11.12 and users are advised to upgrade. Users unable to upgrade may enable the `ignore_panel_config_updates` option as a workaround.

8.4 CVSS 3.1 High EPSS 0.54% · top 56.6% CWE-552 · CWE-552

8.4CVSS 3.1 base score

0.54%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

4References

17 Jun 2026Last modified by NVD

Description

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Wings Pterodactyl

References

Link	Tags
https://github.com/pterodactyl/wings/commit/5415f8ae07f533623bd8169836dd7e0b933964de	Patch
https://github.com/pterodactyl/wings/security/advisories/GHSA-gqmf-jqgv-v8fw	MitigationPatchVendor Advisory
https://github.com/pterodactyl/wings/commit/5415f8ae07f533623bd8169836dd7e0b933964de	Patch
https://github.com/pterodactyl/wings/security/advisories/GHSA-gqmf-jqgv-v8fw	MitigationPatchVendor Advisory

Track CVE-2024-34066 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.8CVE-2023-32080Pterodactyl wings execution with unnecessary privileges vulnerabilityWings is the server control plane for Pterodactyl Panel. A vulnerability affecting versions prior to 1.7.5 and versions 1.11.0 prior to 1.11.6 impact…EPSS 0.92%10 May 2023 8.8CVE-2023-25152Pterodactyl wings link following vulnerabilityWings is Pterodactyl's server control plane. Affected versions are subject to a vulnerability which can be used to create new files and directory str…EPSS 0.68%8 Feb 2023 8.5CVE-2024-27102Pterodactyl wings path traversal vulnerabilityWings is the server control plane for Pterodactyl Panel. This vulnerability impacts anyone running the affected versions of Wings. The vulnerability …EPSS 0.55%13 Mar 2024 8.3CVE-2026-21696Pterodactyl wings uncontrolled resource consumption vulnerabilityWings is the server control plane for Pterodactyl, a free, open-source game server management panel. Starting in version 1.7.0 and prior to version 1…EPSS 0.54%19 Jan 2026 8.3CVE-2025-69199Pterodactyl wings uncontrolled resource consumption vulnerabilityWings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to version 1.12.0, websockets within wings…EPSS 0.29%19 Jan 2026 8.2CVE-2023-25168Pterodactyl wings link following vulnerabilityWings is Pterodactyl's server control plane. This vulnerability can be used to delete files and directories recursively on the host system. This vuln…EPSS 0.96%9 Feb 2023 7.5CVE-2025-68954Pterodactyl panel insufficient session expiration vulnerabilityPterodactyl is a free, open-source game server management panel. Versions 1.11.11 and below do not revoke active SFTP connections when a user is remo…EPSS 0.25%6 Jan 2026 6.5CVE-2021-32699Pterodactyl wings uncontrolled resource consumption vulnerabilityWings is the control plane software for the open source Pterodactyl game management system. All versions of Pterodactyl Wings prior to `1.4.4` are vu…EPSS 0.27%22 Jun 2021

Source: NIST National Vulnerability Database (record CVE-2024-34066), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.