Is CVE-2026-61617 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-61617 being exploited in the wild.

How severe is CVE-2026-61617?

High severity, with a CVSS score of 7.7, published 26 August 2026.

Which products and versions are affected?

Pterodactyl Wings up to and including 1.13.2.

Is there a fix for CVE-2026-61617?

A patch was published on 2026-08-26: Fixed in version 1.13.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-61617 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-61617?

Check whether you run Pterodactyl Wings at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-61617: Pterodactyl Wings SFTP disk quota enforcement bypass

CVE-2026-61617 · Severity: high · CVSS 7.7 · Published 2026-08-26

Wings is the server control plane for Pterodactyl, a game-server management platform that allocates isolated disk space to individual game servers. A vulnerability in SFTP file upload handling allows tenants to bypass disk quotas and write unlimited data to the host node, exhausting its physical disk and causing outages for all servers on that node. An attacker with SFTP access to a single server can take down every server hosted on the same hardware.

Technologies: Pterodactyl Wings. Vendors: Pterodactyl.

Quick answers

Is CVE-2026-61617 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-61617 being exploited in the wild.
How severe is CVE-2026-61617?: High severity, with a CVSS score of 7.7, published 26 August 2026.
Which products and versions are affected?: Pterodactyl Wings up to and including 1.13.2.
Is there a fix for CVE-2026-61617?: A patch was published on 2026-08-26: Fixed in version 1.13.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-61617 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-61617?: Check whether you run Pterodactyl Wings at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The SFTP write path in Wings performs disk quota validation only once, as a stale boolean check when opening a file handle, using cached usage values and without knowledge of incoming data size. After the handle is opened, subsequent writes are never re-checked against the quota and proceed unbounded to the underlying filesystem. Additionally, a server stopped by Wings for exceeding its limit is not marked suspended, so SFTP writes continue to be accepted even after quota exhaustion. An attacker with SFTP credentials can open a single file and write indefinitely past the configured server limit until the node's physical disk is full, taking down all co-hosted servers. The fix, available in version 1.13.3, enforces quota checks on each individual write operation and properly bounds transfers by remaining quota.

Affected products

Pterodactyl Wings up to and including 1.13.2

Timeline

2026-08-14: disclosed
2026-08-26: patched: Fixed in version 1.13.3

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.