Vulnerability in Pterodactyl Wings

CVE-2026-52856

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.13.0, a malformed packet received during the SFTP connection handshake causes a Go panic. This issue is fixed in version 1.13.0.

Published 2026-07-31 · last modified 2026-10-23.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

EPSS exploit prediction

EPSS 0.006, 49.5th percentile (scored 2026-11-11); unchanged over 30 days. About EPSS.

Affected products

Pterodactyl Wings — versions < 1.13.0

Weakness classification (CWE)

CWE-129 — Improper Validation of Array Index
CWE-248
CWE-617 — Reachable Assertion
CWE-755 — Improper Handling of Exceptional Conditions

Public exploits and proof-of-concept code

1 public repository with exploit or proof-of-concept code for this CVE:

lisbickq/CVE-2026-52856-PoC (last pushed 2026-10-19): PoC For CVE-2026-52856

References

https://github.com/pterodactyl/wings/security/advisories/GHSA-ghrq-5wpp-hxx5
https://github.com/pterodactyl/wings/commit/8e49c7c0eda815d3ada171831876a1c14c493026
https://github.com/pterodactyl/wings/releases/tag/v1.13.0

This CVE has public exploit evidence. See the latest CVEs with public exploits.