CVE-2024-34066: pterodactyl wings

csirt@kutim:~/threat-intel/cve/CVE-2024-34066

CVSS 8.4 · High EPSS 0,54%

Kerentanan Files or Directories Accessible to External Parties pada pterodactyl wings. Skor CVSS 3.1 8.4 (High) menurut NVD.

Deskripsi (NVD)

Pterodactyl wings is the server control plane for Pterodactyl Panel. If the Wings token is leaked either by viewing the node configuration or posting it accidentally somewhere, an attacker can use it to gain arbitrary file write and read access on the node the token is associated to. This issue has been addressed in version 1.11.12 and users are advised to upgrade. Users unable to upgrade may enable the `ignore_panel_config_updates` option as a workaround.

Rincian

Terbit di NVD: 3 Mei 2024
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 8.4 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-552: Files or Directories Accessible to External Parties
EPSS (30 hari): 0,54% peluang dieksploitasi; lebih tinggi dari 44,1% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
pterodactyl	wings	Semua versi sebelum 1.11.2

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/pterodactyl/wings/security/advisories/GHSA-gqmf-jqgv-v8fw mitigasi · patch · advisory vendor
https://github.com/pterodactyl/wings/commit/5415f8ae07f533623bd8169836dd7e0b933964de patch

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.