CVE-2023-25168

highPriorität · verfolgen · 33EPSS 0.010 · 61. PerzentilEUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.96% (61st) EPSS

CVSS 8.2 · high

Is it mine?

9 products

Prüfe deine Angriffsfläche

Who says so?

4 sources

cnnvd · enisa_euvd · osv · nvd

EPSS · bewertet 2026-10-27

Wings is Pterodactyl's server control plane. This vulnerability can be used to delete files and directories recursively on the host system. This vulnerability can be combined with `GHSA-p8r3-83r8-jwj5` to overwrite files on the host system. In order to use this exploit, an attacker must have an existing "server" allocated and controlled by Wings. This vulnerability has been resolved in version `v1.11.4` of Wings, and has been back-ported to the 1.7 release series in `v1.7.4`. Anyone running `v1.11.x` should upgrade to `v1.11.4` and anyone running `v1.7.x` should upgrade to `v1.7.4`. There are no known workarounds for this issue.

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

9.6

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · high–critical · 7.5–9.6

v3.18.2highCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:Hprimary · NVD / NIST USAusnutzbarkeit 1.8 · Auswirkung 5.8

v3.19.6criticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:Hsecondary · ENISA EU

v3.19.6criticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:Hsecondary · security-advisories@github.comAusnutzbarkeit 3.1 · Auswirkung 5.8

v3.19.6criticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:Hsecondary · OSV

v3.17.5highCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Trackcoordinatorcisa_ssvcUS

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-59USprimärCWE-59US

betroffene Produkte (9)

Betroffene Produkte und Versionsbereiche.

pterodactyl wings≤ < 1.7.4enisa_euvdEU
pterodactyl wings1.11.0, → 1.11.4enisa_euvdEU
pterodactyl wings= 1.11.0nvdUScpe:2.3:a:pterodactyl:wings:*:*:*:*:*:*:*:*
pterodactyl wings= 1.11.1nvdUScpe:2.3:a:pterodactyl:wings:*:*:*:*:*:*:*:*
pterodactyl wings= 1.11.2nvdUScpe:2.3:a:pterodactyl:wings:*:*:*:*:*:*:*:*
pterodactyl wings= 1.11.3nvdUScpe:2.3:a:pterodactyl:wings:*:*:*:*:*:*:*:*
pterodactyl wings1.7.0 → 1.7.4nvdUScpe:2.3:a:pterodactyl:wings:*:*:*:*:*:*:*:*
Go github.com/pterodactyl/wings< 1.7.4osvUSpkg:golang/github.com/pterodactyl/wings
Go github.com/pterodactyl/wings1.11.0 → 1.11.4osvUSpkg:golang/github.com/pterodactyl/wings

Advisories (2)

Hersteller- und Ökosystem-Meldungen dazu.

GHSA-66p8-j459-rq63Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following resulting in deletion of files and directories on the host system2023-02-10ghsa · osvUS
### Impact This vulnerability impacts anyone running the affected versions of Wings. The vulnerability can be used to delete files and directories recursively on the host system. This vulnerability can be combined with [`GHSA-p8r3-83r8-jwj5`](https://github.com/pterodactyl/wings/security/advisories/GHSA-p8r3-83r8-jwj5) to overwrite files on the host system. In order to use this exploit, an attacker must have an existing "server" allocated and controlled by Wings. Information on how the exploitation of this vulnerability works will be released on February 24th, 2023 in North America. ### Patches This vulnerability has been resolved in version `v1.11.4` of Wings, and has been back-ported to the 1.7 release series in `v1.7.4`. Anyone running `v1.11.x` should upgrade to `v1.11.4` and anyone running `v1.7.x` should upgrade to `v1.7.4`. ### Workarounds None at this time.
GO-2023-1555Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following resulting in deletion of files and directories on the host system in github.com/pterodactyl/wings2024-08-20vendor · osvUS
Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following resulting in deletion of files and directories on the host system in github.com/pterodactyl/wings

auch bekannt als (5)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd osv nvd NVD CVE.org MITRE

veröffentlicht 2023-02-09geändert 2026-06-17

verwandt (2,372)

Verwandte Einträge.

ID	Schweregrad	EPSS	ausnutzbar	veröffentlicht
CVE-2026-81963US	high7.8OT kritisch	0.39% (33rd)	KEV	2026-09-08
Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate privileges locally.
CVE-2026-41091US	—OT kritisch	8.20% (95th)	KEV	2026-05-20
Improper link resolution before file access ('link following') in Microsoft Defender allows an authorized attacker to elevate privileges locally.
CVE-2025-60710US	—OT kritisch	4.61% (92nd)	KEV	2025-11-11
Improper link resolution before file access ('link following') in Host Process for Windows Tasks allows an authorized attacker to elevate privileges locally.
CVE-2025-48384US	—OT kritisch	4.38% (91st)	KEV	2025-07-08
Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When reading…
CVE-2025-21391US	—OT kritisch	2.28% (83rd)	KEV	2025-02-11
Windows Storage Elevation of Privilege Vulnerability

+2367 weitere

Referenzen (11)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan