CVE-2025-68954
Pterodactyl is a free, open-source game server management panel. Versions 1.11.11 and below do not revoke active SFTP connections when a user is removed from a server instance or has their permissions changes with respect to file access over SFTP. This allows a user that was already connected to SFTP to remain connected and access files even after their permissions are revoked. A user must have been connected to SFTP at the time of their permissions being revoked in order for this vulnerability to be exploited. This issue is fixed in version 1.12.0.
- CVSS 4.0
- 7.5
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 5.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - EPSS
- 0.2% chance of exploitation in the next 30 days; higher than 15% of CVEs (scores of 2026-10-25)
- CWE
- CWE-613
- Published
- Modified
- Record from
- the NVD, synced
Affected
- pterodactyl:panel
- pterodactyl:wings
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-8c39-xppg-479c | Packagist | pterodactyl/panel | <1.12.0 | 1.12.0 |
| GHSA-8c39-xppg-479c | Go | github.com/pterodactyl/wings | <1.12.0 | 1.12.0 |
| GO-2026-4283 | Go | github.com/pterodactyl/wings | <1.12.0 | 1.12.0 |