CVE-2026-61617

Name of the Vulnerable Software and Affected Versions Wings versions prior to 1.13.3

Description The SFTP write path fails to enforce disk quotas during file transfers. The system performs a single boolean check for available space using a stale cached value when the write handle is opened, without considering the size of the incoming data. Consequently, it provides a raw file handle that is not re-evaluated during the transfer process. This allows a user with SFTP write access to upload data without bounds, potentially exhausting the host node's physical disk space and causing a denial of service for all servers hosted on that node. Additionally, servers stopped for exceeding their limit are not treated as suspended, allowing SFTP writes to continue even after the quota is exceeded.

Recommendations Update to version 1.13.3.