CVE-2026-61617: CWE-770: Allocation of Resources Without Limits or Throttling in pterodactyl wings

Pterodactyl Wings versions up to 1.13.2 have a resource allocation vulnerability (CWE-770) where the SFTP write path does not enforce disk quotas during file transfers. Wings performs a single boolean check of available disk space when opening the write handle, relying on stale cached usage data and not accounting for the size of incoming files. The file handle remains open without further quota checks, allowing unbounded writes that can fill the host node's disk. Servers exceeding their quota are stopped but not suspended, so SFTP writes continue even after disk limits are surpassed. This can lead to denial of service affecting all servers on the node. The vulnerability is addressed in version 1.13.3.

An attacker with SFTP write access to a single server can exhaust the physical disk space of the host node by uploading files beyond the configured disk quota. This results in denial of service for all servers running on that node due to disk exhaustion. The vulnerability does not impact confidentiality or integrity but causes high availability impact.

A fix is available in Pterodactyl Wings version 1.13.3. Users should upgrade to this version to ensure proper enforcement of disk quotas during SFTP transfers. Patch status is not explicitly confirmed in the vendor advisory, but the description states the issue is fixed in 1.13.3. Until upgraded, administrators should monitor disk usage closely and consider restricting SFTP write access.