CVE-2023-25168 json
Symbolic Link (Symlink) Following allowing the deletion of files and directories on the host system in wings
published 2023-02-08 3 y ago modified 2026-06-17 4 mo ago also GHSA-66p8-j459-rq63 , GO-2023-1555 , EUVD-2023-0638
- cvss
- 9.6
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.0%
- EPSS 1.0% chance of exploitation in 30 days, percentile 61%
- public exploits
- 0
- none known
Summary
Wings is Pterodactyl's server control plane. This vulnerability can be used to delete files and directories recursively on the host system. This vulnerability can be combined with `GHSA-p8r3-83r8-jwj5` to overwrite files on the host system. In order to use this exploit, an attacker must have an existing "server" allocated and controlled by Wings. This vulnerability has been resolved in version `v1.11.4` of Wings, and has been back-ported to the 1.7 release series in `v1.7.4`. Anyone running `v1.11.x` should upgrade to `v1.11.4` and anyone running `v1.7.x` should upgrade to `v1.7.4`. There are no known workarounds for this issue.
Patch / fix
- go github.com/pterodactyl/wings 1.7.4, 1.11.4
- pterodactyl wings 1.7.4
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 20 mo ago
Exploit prediction
0.96% chance of exploitation in the next 30 days, higher than 61% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 9.6 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H |
| NVD | 3.1 | 8.2 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:H |
| GitHub | 3.1 | 9.6 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/pterodactyl/wings | <1.7.4 >=1.11.0, <1.11.4 |
1.7.4 1.11.4 |
Affected products
- pterodactyl wings
Classification
- Weakness
-
- CWE-59 Improper Link Resolution Before File Access
References
-
github.com
/pterodactyl/wings/commit/429ac62dba22997a278bc709df5ac00a5a25d83d
web, patch, vendor-advisory
-
github.com
/pterodactyl/wings/security/advisories/GHSA-66p8-j459-rq63
web, vendor-advisory, advisory
-
github.com
/pterodactyl/wings/security/advisories/GHSA-p8r3-83r8-jwj5
web, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2023-25168
advisory
-
github.com
/pterodactyl/wings
package
Sources
- CVE List CVE-2023-25168
- GitHub Advisory GHSA-66p8-j459-rq63
- NVD CVE-2023-25168
- OSV GO-2023-1555
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.