HIGH🇵🇱 Wersja polska

CVE-2025-68954

CVSS 7.5v4.0pub. 2026-01-06upd. 2026-01-12

Pterodactyl is a free, open-source game server management panel. Versions 1.11.11 and below do not revoke active SFTP connections when a user is removed from a server instance or has their permissions changes with respect to file access over SFTP. This allows a user that was already connected to SFTP to remain connected and access files even after their permissions are revoked. A user must have been connected to SFTP at the time of their permissions being revoked in order for this vulnerability to be exploited. This issue is fixed in version 1.12.0.

CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

  • Pterodactyl Panel

    APP
    Pterodactyl
    < 1.12.0

  • Pterodactyl Wings

    APP
    Pterodactyl
    < 1.12.0
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2026-26016CRITICAL9.2PL ✓ten sam produkt

Brak autoryzacji w Pterodactyl Wings — dostęp do danych serwerów innych węzłów

CVE-2024-27102CRITICAL9.9PL ✓ten sam produkt

Path Traversal w Pterodactyl Wings — dostęp do plików poza sandbox

CVE-2023-32080CRITICAL9.0ten sam produkt

Wings is the server control plane for Pterodactyl Panel. A vulnerability affecting versions prior to 1.7.5 and...

CVE-2023-25168CRITICAL9.6ten sam produkt

Wings is Pterodactyl's server control plane. This vulnerability can be used to delete files and directories re...

CVE-2025-69199HIGH8.3ten sam produkt

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to ...