← Vulnerability feed

Vulnerability record · CVE-2024-34067 · published 3 May 2024

CVE-2024-34067: Pterodactyl panel cross-site scripting vulnerability

Pterodactyl · Panel

Pterodactyl is a free, open-source game server management panel built with PHP, React, and Go. Importing a malicious egg or gaining access to wings instance could lead to cross site scripting (XSS) on the panel, which could be used to gain an administrator account on the panel. Specifically, the following things are impacted: Egg Docker images and Egg variables: Name, Environment variable, Default value, Description, Validation rules. Additionally, certain fields would reflect malicious input, but it would require the user knowingly entering such input to have an impact. To iterate, this would require an administrator to perform actions and can't be triggered by a normal panel user. This issue has has been addressed in version 1.11.6 and users are advised to upgrade. No workaround is available other than updating to the latest version of the panel.

6.1 CVSS 3.1 Medium EPSS 0.46% · top 62.8% CWE-79 · Cross-site scripting
6.1CVSS 3.1 base score
0.46%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
8References
17 Jun 2026Last modified by NVD

Description

Pterodactyl is a free, open-source game server management panel built with PHP, React, and Go. Importing a malicious egg or gaining access to wings instance could lead to cross site scripting (XSS) on the panel, which could be used to gain an administrator account on the panel. Specifically, the following things are impacted: Egg Docker images and Egg variables: Name, Environment variable, Default value, Description, Validation rules. Additionally, certain fields would reflect malicious input, but it would require the user knowingly entering such input to have an impact. To iterate, this would require an administrator to perform actions and can't be triggered by a normal panel user. This issue has has been addressed in version 1.11.6 and users are advised to upgrade. No workaround is available other than updating to the latest version of the panel.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/pterodactyl/panel/commit/0dad4c5a488661f9adc27dd311542516d9bfa0f2 Patch
https://github.com/pterodactyl/panel/commit/1172d71d31561c4e465dabdf6b838e64de48ad16 Patch
https://github.com/pterodactyl/panel/commit/f671046947e4695b5e1c647df79305c1cefdf817 Patch
https://github.com/pterodactyl/panel/security/advisories/GHSA-384w-wffr-x63q Vendor Advisory
https://github.com/pterodactyl/panel/commit/0dad4c5a488661f9adc27dd311542516d9bfa0f2 Patch
https://github.com/pterodactyl/panel/commit/1172d71d31561c4e465dabdf6b838e64de48ad16 Patch
https://github.com/pterodactyl/panel/commit/f671046947e4695b5e1c647df79305c1cefdf817 Patch
https://github.com/pterodactyl/panel/security/advisories/GHSA-384w-wffr-x63q Vendor Advisory

Track CVE-2024-34067 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.2CVE-2026-26016Pterodactyl panel insecure direct object reference vulnerabilityWings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to version 1.12.1, a missing authorization…EPSS 0.46%8.1CVE-2021-41129Pterodactyl panel deserialization of untrusted data vulnerabilityPterodactyl is an open-source game server management panel built with PHP 7, React, and Go. A malicious user can modify the contents of a `confirmati…EPSS 1.8%7.5CVE-2025-68954Pterodactyl panel insufficient session expiration vulnerabilityPterodactyl is a free, open-source game server management panel. Versions 1.11.11 and below do not revoke active SFTP connections when a user is remo…EPSS 0.25%7.5CVE-2019-1020002Pterodactyl panel observable discrepancy vulnerabilityPterodactyl before 0.7.14 with 2FA allows credential sniffing.EPSS 1.5%6.5CVE-2025-69197Pterodactyl panel improper authentication vulnerabilityPterodactyl is a free, open-source game server management panel. Versions 1.11.11 and below allow TOTP to be used multiple times during its validity …EPSS 0.36%6.0CVE-2025-69198Pterodactyl panel uncontrolled resource consumption vulnerabilityPterodactyl is a free, open-source game server management panel. Pterodactyl implements rate limits that are applied to the total number of resources…EPSS 0.24%4.3CVE-2021-41273Pterodactyl panel cross-site request forgery vulnerabilityPterodactyl is an open-source game server management panel built with PHP 7, React, and Go. Due to improperly configured CSRF protections on two rout…EPSS 0.39%4.3CVE-2021-41176Pterodactyl panel cross-site request forgery vulnerabilityPterodactyl is an open-source game server management panel built with PHP 7, React, and Go. In affected versions of Pterodactyl a malicious user can …EPSS 0.52%

Source: NIST National Vulnerability Database (record CVE-2024-34067), CISA KEV, FIRST EPSS (scores of 2026-09-28). This page is refreshed as NVD updates the record.