CVE-2026-61617 in Wings
Summary
by MITRE • 08/27/2026
Wings is the server control plane for the Pterodactyl game-server management panel. In versions up to and including 1.13.2, the SFTP write path does not enforce a server's disk quota during a transfer, allowing a tenant with SFTP write access to a single server to exhaust the host node's physical disk and take down every server on it. Wings checks available space only once, as a boolean, when the write handle is opened, using a stale cached usage value and without knowing the size of the incoming data, and it then returns a raw, unaccounted file handle that is never re-checked as the transfer proceeds. A single upload can therefore be written without bound, far beyond the configured disk limit, until the node's disk is full, and because a server stopped for exceeding its limit is not treated as suspended, SFTP writes are still accepted even after the quota is already exceeded. This issue is fixed in version 1.13.3.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/27/2026
The vulnerability identified in Wings, the server control plane component of the Pterodactyl game-server management panel, represents a critical failure in resource enforcement mechanisms within multi-tenant hosting environments. In versions up to and including 1.13.2, the system fails to properly enforce disk quotas during Secure File Transfer Protocol (SFTP) write operations. This flaw allows an authenticated tenant with SFTP write access to a specific server instance to exhaust the physical storage capacity of the underlying host node. The consequences are severe, as filling the host's disk can lead to the failure or unavailability of all other servers hosted on that same node, effectively causing a denial-of-service condition for multiple unrelated tenants due to shared infrastructure resources.
The technical root cause lies in how Wings handles file write operations and quota validation. When an SFTP connection initiates a write request, the system performs only a single check against available disk space at the moment the write handle is opened. This check relies on a stale cached value of current usage rather than real-time data, meaning it does not account for concurrent writes or rapid changes in storage consumption. Furthermore, the initial validation acts merely as a boolean pass/fail gate without considering the size of the incoming file transfer. Once this preliminary check passes, Wings returns an unaccounted raw file handle to the client. Crucially, there is no subsequent verification loop during the actual data transmission process to ensure that cumulative writes remain within the allocated limits.
Compounding this issue is a logical flaw in the state management of servers that exceed their quotas. When a server's usage surpasses its configured disk limit, Wings does not transition the server into a suspended or stopped state that would inherently block further write operations. Instead, SFTP connections to such over-quota servers remain active and accept new data writes. This design oversight means that even after a tenant has technically violated their storage agreement, they can continue uploading files indefinitely until the physical disk is completely full. The combination of infrequent quota checks, lack of size awareness during transfer, and persistent write permissions for non-suspended over-quota servers creates an exploitable path for resource exhaustion.
From a classification perspective, this vulnerability aligns with CWE-787: Out-of-bounds Write, as the system allows data to be written beyond allocated boundaries due to insufficient boundary checks. It also relates closely to CWE-400: Uncontrolled Resource Consumption, where an attacker can cause the system to consume excessive resources (disk space) leading to denial of service. In terms of adversarial tactics, this flaw facilitates actions consistent with ATT&CK technique T1526: Cloud Service Discovery or more broadly T1498: Network Denial of Service via resource exhaustion in a cloud environment, as the attacker leverages legitimate access mechanisms to degrade the availability of shared infrastructure services.
The operational impact extends beyond simple storage depletion. A full disk on a host node can prevent critical system processes from logging errors, create temporary files required for normal operation, or cause database corruption if those databases reside on the same volume. For managed hosting providers running Pterodactyl Wings, this vulnerability undermines the fundamental isolation guarantees expected in multi-tenant architectures. It exposes all customers sharing that hardware to risk based on the actions of a single malicious or misconfigured tenant. The lack of real-time monitoring during transfers means detection is often reactive rather than proactive, allowing significant damage before intervention occurs.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. The primary solution is upgrading Wings to version 1.13.3 or later, where the developers have implemented proper quota enforcement mechanisms that check available space continuously during transfers and correctly handle state transitions for over-quota servers. For environments unable to upgrade immediately, administrators should implement external monitoring solutions that detect rapid disk usage spikes and automatically suspend affected server instances via API calls before they exhaust host resources. Additionally, configuring operating-level quotas using tools like Linux Disk Quotas or ZFS/ZVOL limits can provide a hard barrier independent of the application logic, ensuring that even if Wings fails to enforce limits, the underlying file system prevents further writes beyond allocated boundaries. Regular audits of SFTP access permissions and implementing rate limiting on upload speeds can also reduce the risk profile associated with this vulnerability class.