CVE-2026-54593

Name of the Vulnerable Software and Affected Versions Pterodactyl Panel versions prior to 1.12.3 Pterodactyl Wings versions prior to 1.12.2

Description A privilege escalation issue exists in the Wings '/upload/file' endpoint. The system accepts any valid panel-signed JSON Web Token (JWT) containing server uuid, user uuid, and unique id claims without verifying the token's intended purpose. Since the Panel issues JWTs with these same claims for lower-privilege operations, such as WebSocket authentication and file-download links, an authenticated subuser can reuse a token obtained for a limited action (e.g., using the websocket.connect permission) to write arbitrary files to the server, bypassing the requirement for the file.create permission.

Recommendations Update Pterodactyl Panel to version 1.12.3 or later. Update Pterodactyl Wings to version 1.12.2 or later.