Executive brief
Wings is the server control plane for Pterodactyl, a game-server management platform that allocates isolated disk space to individual game servers. A vulnerability in SFTP file upload handling allows tenants to bypass disk quotas and write unlimited data to the host node, exhausting its physical disk and causing outages for all servers on that node. An attacker with SFTP access to a single server can take down every server hosted on the same hardware.
Technical details
The SFTP write path in Wings performs disk quota validation only once, as a stale boolean check when opening a file handle, using cached usage values and without knowledge of incoming data size. After the handle is opened, subsequent writes are never re-checked against the quota and proceed unbounded to the underlying filesystem. Additionally, a server stopped by Wings for exceeding its limit is not marked suspended, so SFTP writes continue to be accepted even after quota exhaustion. An attacker with SFTP credentials can open a single file and write indefinitely past the configured server limit until the node's physical disk is full, taking down all co-hosted servers. The fix, available in version 1.13.3, enforces quota checks on each individual write operation and properly bounds transfers by remaining quota.
Affected products
- Pterodactyl Wings up to and including 1.13.2
Timeline
- 2026-08-14: disclosed
- 2026-08-26: patched: Fixed in version 1.13.3