CVE-2024-34066

Pterodactyl wings is the server control plane for Pterodactyl Panel. If the Wings token is leaked either by viewing the node configuration or posting it accidentally somewhere, an attacker can use it to gain arbitrary file write and read access on the node the token is associated to. This issue has been addressed in version 1.11.12 and users are advised to upgrade. Users unable to upgrade may enable the `ignore_panel_config_updates` option as a workaround.

• CWE-552
• CWE-552

• https://github.com/pterodactyl/wings/commit/5415f8ae07f533623bd8169836dd7e0b933964dePatch
• https://github.com/pterodactyl/wings/security/advisories/GHSA-gqmf-jqgv-v8fwMitigation, Patch, Vendor Advisory
• https://github.com/pterodactyl/wings/commit/5415f8ae07f533623bd8169836dd7e0b933964dePatch
• https://github.com/pterodactyl/wings/security/advisories/GHSA-gqmf-jqgv-v8fwMitigation, Patch, Vendor Advisory

Published

May 3, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-34060IrisEVTXModule is an interface module for Evtx2Splunk and Ir…8.8
• CVE-2024-34061changedetection.io is a free open source web page change det…4.3
• CVE-2024-34062tqdm is an open source progress bar for Python and CLI. Any …4.8
• CVE-2024-34063vodozemac is an implementation of Olm and Megolm in pure Rus…2.5
• CVE-2024-34064Jinja is an extensible templating engine. The `xmlattr` filt…5.4
• CVE-2024-34065Strapi is an open-source content management system. By combi…8.1
• CVE-2024-34067Pterodactyl is a free, open-source game server management pa…6.1
• CVE-2024-34068Pterodactyl wings is the server control plane for Pterodacty…6.4
• CVE-2024-34069Werkzeug is a comprehensive WSGI web application library. Th…7.5
• CVE-2024-3407The WP Prayer WordPress plugin through 2.0.9 does not have C…5.3
• CVE-2024-34070Froxlor is open source server administration software. Prior…9.6
• CVE-2024-34071Umbraco is an ASP.NET CMS used by more than 730.000 websites…6.1