Pterodactyl panel versions before 1.12.3 and Wings before 1.12.2 have an improper restriction of security token assignment (CWE-1259). The Wings /upload/file endpoint accepts any valid panel-signed JWT containing server_uuid, user_uuid, and unique_id claims without verifying the token's intended use. Since the panel issues JWTs with these claims for various lower-privilege operations (e.g., WebSocket authentication, file-download links), an authenticated subuser with a token for a low-privilege operation (such as websocket.connect) can replay that token against the /upload/file endpoint to write arbitrary files to the server. This bypasses the required file.create permission. The vulnerability is resolved in Panel version 1.12.3 and Wings version 1.12.2.

An authenticated subuser without file creation permissions can escalate privileges by reusing JWT tokens intended for other operations to upload arbitrary files to the server. This can lead to integrity and availability impacts on the affected server. The CVSS 3.1 score is 8.1 (high), reflecting network attack vector, low attack complexity, required privileges, no user interaction, unchanged scope, no confidentiality impact, but high integrity and availability impact.

This vulnerability is fixed in Pterodactyl Panel version 1.12.3 and Wings version 1.12.2. Users should upgrade to these or later versions to remediate the issue. No other mitigation or temporary workaround is indicated by the vendor advisory. Patch status is not explicitly stated but the fix versions are known; users should apply these updates promptly.