CVE-2026-54593 Details
Description
Pterodactyl is a free, open-source game server management panel. Prior to Panel version 1.12.3 and Wings version 1.12.2, the Wings /upload/file endpoint accepted any valid panel-signed JWT that contained server_uuid, user_uuid, and unique_id claims without checking the token's intended purpose; because the Panel issues JWTs carrying those same claims for lower-privilege operations such as WebSocket authentication and file-download links, an authenticated subuser could reuse one of those tokens (for example a WebSocket token obtained with only the websocket.connect permission) by replaying it against /upload/file to write arbitrary files to the same server, despite never being granted the file.create permission. This issue is fixed in Panel version 1.12.3 and Wings version 1.12.2.
A vulnerability in Pterodactyl Wings prior to version 1.12.2 allows for privilege escalation through improper validation of panel-signed JSON Web Tokens (JWTs) in the /upload/file endpoint. Wings accepts any valid JWT that includes server_uuid, user_uuid, and unique_id claims, without verifying the token's intended use. This flaw enables an authenticated subuser to exploit lower-privilege tokens, such as those for WebSocket connections or file downloads, to upload arbitrary files to a server, bypassing the need for explicit file creation permissions.
Users can update to Pterodactyl Panel version 1.12.3 and Wings version 1.12.2, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 28, 2026CISA-ADP
Assessed Jul 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/pterodactyl/panel/commit/7ffcd636310bb72b54bac3280d2a15e727feded7 | [email protected] | Source CodeVendor |
| https://github.com/pterodactyl/panel/pull/5636 | [email protected] | Issue TrackingVendor |
| https://github.com/pterodactyl/panel/security/advisories/GHSA-8r6w-3qq5-4p4r | [email protected] | AdvisoryRemedyVendor |
| https://github.com/pterodactyl/wings/commit/d0ddc80844479302abdaf9654de3bacd511c0f5c | [email protected] | Source CodeVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1259 | Improper Restriction of Security Token Assignment | [email protected] |
| CWE-1270 | Generation of Incorrect Security Tokens | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Pterodactyl | < 1.12.3 (semver) |
CPE
Remediation
| |
| Pterodactyl Wings | < 1.12.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 28, 2026 | CVE Modified | CISA-ADP |
| Jul 28, 2026 | New CVE Received | [email protected] |