CVE-2025-68954
High · 7.2Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced
CVSS
7.2
EPSS
0.2%
Published
Jan 6, 2026
CISA due date
—
The record
Pterodactyl does not revoke _active_ SFTP connections when a user is removed from a server instance or has their permissions changes with respect to file access over SFTP. This allows a user that was already connected to SFTP to remain connected and access files even after their permissions are revoked.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/pterodactyl/wings | 0 | 1.12.0 |
| Packagist | pterodactyl/panel | 0 | 1.12.0 |
| openSUSE:Leap 15.6 | govulncheck-vulndb | 0 | 0.0.20260114T191543-150000.1.137.1 |
Related vulnerabilities
- GHSA-8c39-xppg-479c Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced Same vulnerability
- GHSA-hr7j-63v7-vj7g Pterodactyl Panel's SFTP sessions remain active after user account deletion or password… Also affects github.com/pterodactyl/wings
- GO-2026-4329 Pterodactyl endlessly reprocesses/reuploads activity log data due to SQLite max… Also affects github.com/pterodactyl/wings
- GO-2026-4331 Pterodactyl websocket endpoints have no visible rate limits or monitoring, allowing for… Also affects github.com/pterodactyl/wings
- CVE-2026-21696 Wings is the server control plane for Pterodactyl, a free, open-source game server… Also affects github.com/pterodactyl/wings
- CVE-2025-69199 Wings is the server control plane for Pterodactyl, a free, open-source game server… Also affects github.com/pterodactyl/wings
- CVE-2026-26016 Wings is the server control plane for Pterodactyl, a free, open-source game server… Also affects pterodactyl/panel
- GHSA-g7vw-f8p5-c728 Pterodactyl Panel Allows Cross-Node Server Configuration Disclosure via Remote API… Also affects pterodactyl/panel