Threats affecting pkg:golang/github.com/pterodactyl/wings

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.13.0, a malformed packet received during the SFTP connection handshake causes a Go panic. This issue is fixed in version 1.13.0.

A vulnerability in Pterodactyl Wings allows changing file permissions outside the server container by exploiting symlinks. The function responsible for changing file permissions does not prevent following symlinks, enabling modification of host files' permissions. This affects versions from 1.11.9 up to but not including 1.12.2.