The vulnerability exists in the `fchmodat` function call within Pterodactyl Wings (file wings/internal/ufs/fs_unix.go). The call to the Unix system function `fchmodat` lacks the `AT_SYMLINK_NOFOLLOW` flag and does not validate whether the target is a symlink. This allows an attacker with permission to invoke this function to change the permissions of files outside the intended server container by creating symlinks to host files and then performing chmod operations on them. This can lead to unauthorized modification of file permissions on the host system.

An attacker with limited privileges on the server container can modify file permissions on the host system by exploiting symlinks. This does not directly lead to confidentiality loss or denial of service but can cause integrity issues by altering file permissions outside the container boundary, potentially enabling further attacks or unauthorized access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the Wings service to trusted users only and monitor for suspicious symlink creation or chmod operations. Avoid running Wings with elevated privileges that could increase the impact of this vulnerability.