CVE-2026-52856

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.13.0, a malformed packet received during the SFTP connection handshake causes a Go panic. This issue is fixed in version 1.13.0.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/pterodactyl/wings/commit/8e49c7c0eda815d3ada171831876a1c14c493026
https://github.com/pterodactyl/wings/releases/tag/v1.13.0
https://github.com/pterodactyl/wings/security/advisories/GHSA-ghrq-5wpp-hxx5

Configurations

No configuration.

History

23 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) Wings es el plano de control del servidor para Pterodactyl, un panel de gestión de servidores de juegos gratuito y de código abierto. Antes de la versión 1.13.0, un paquete malformado recibido durante el handshake de la conexión SFTP causa un pánico de Go. Este problema está solucionado en la versión 1.13.0.

Information

Published : 2026-07-31 17:16

Updated : 2026-10-23 23:10

NVD link : CVE-2026-52856

Mitre link : CVE-2026-52856

CVE.ORG link : CVE-2026-52856

JSON object : View

Products Affected

No product.

CWE

CWE-129

Improper Validation of Array Index

CWE-248

Uncaught Exception

CWE-617

Reachable Assertion

CWE-755

Improper Handling of Exceptional Conditions

{"id": "CVE-2026-52856", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-52856", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-31T18:57:27.226859Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "pterodactyl", "product": "wings", "versions": [{"status": "affected", "version": "< 1.13.0"}]}]}], "published": "2026-07-31T17:16:33.460", "references": [{"url": "https://github.com/pterodactyl/wings/commit/8e49c7c0eda815d3ada171831876a1c14c493026", "source": "security-advisories@github.com"}, {"url": "https://github.com/pterodactyl/wings/releases/tag/v1.13.0", "source": "security-advisories@github.com"}, {"url": "https://github.com/pterodactyl/wings/security/advisories/GHSA-ghrq-5wpp-hxx5", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-129"}, {"lang": "en", "value": "CWE-248"}, {"lang": "en", "value": "CWE-617"}, {"lang": "en", "value": "CWE-755"}]}], "descriptions": [{"lang": "en", "value": "Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.13.0, a malformed packet received during the SFTP connection handshake causes a Go panic. This issue is fixed in version 1.13.0."}, {"lang": "es", "value": "Wings es el plano de control del servidor para Pterodactyl, un panel de gesti\u00f3n de servidores de juegos gratuito y de c\u00f3digo abierto. Antes de la versi\u00f3n 1.13.0, un paquete malformado recibido durante el handshake de la conexi\u00f3n SFTP causa un p\u00e1nico de Go. Este problema est\u00e1 solucionado en la versi\u00f3n 1.13.0."}], "lastModified": "2026-10-23T23:10:00.157", "sourceIdentifier": "security-advisories@github.com"}