Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.7
CVE-2026-61617: Pterodactyl Wings SFTP can fill node disk
CVE-2026-61617 · published 2 months ago
Summary
In Pterodactyl Wings versions up to 1.13.2, the file‑transfer function does not keep checking how much disk space is left while a file is being uploaded. This lets someone with upload rights fill the entire disk of the host machine, which can bring down every game server on that machine. Upgrade to version 1.13.3 or newer to restore proper limits.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| pterodactyl | wings | < 1.13.3 |
Original advisory text
Pterodactyl Wings SFTP write path does not enforce disk quota, allowing node-wide disk exhaustion
Wings is the server control plane for the Pterodactyl game-server management panel. In versions up to and including 1.13.2, the SFTP write path does not enforce a server's disk quota during a transfer, allowing a tenant with SFTP write access to a single server to exhaust the host node's physical disk and take down every server on it. Wings checks available space only once, as a boolean, when the write handle is opened, using a stale cached usage value and without knowing the size of the incoming data, and it then returns a raw, unaccounted file handle that is never re-checked as the transfer proceeds. A single upload can therefore be written without bound, far beyond the configured disk limit, until the node's disk is full, and because a server stopped for exceeding its limit is not treated as suspended, SFTP writes are still accepted even after the quota is already exceeded. This issue is fixed in version 1.13.3.
References
- https://github.com/pterodactyl/wings/security/advisories/GHSA-8j54-xcwx-597p Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/61xxx/CVE-2026-61617... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-61617 Vendor Advisory
- https://github.com/pterodactyl/wings/commit/da1a216cfff5867fa66be32cb1edb93e37fd... Patch
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-770Allocation of Resources Without Limits
CWE-400Uncontrolled Resource Consumption
Timeline
Published26 Aug 2026
Updated4 Nov 2026
First seen26 Aug 2026
Track software like this
Free during beta