Description

Wings is the server control plane for the Pterodactyl game-server management panel. In versions up to and including 1.13.2, the SFTP write path does not enforce a server's disk quota during a transfer, allowing a tenant with SFTP write access to a single server to exhaust the host node's physical disk and take down every server on it. Wings checks available space only once, as a boolean, when the write handle is opened, using a stale cached usage value and without knowing the size of the incoming data, and it then returns a raw, unaccounted file handle that is never re-checked as the transfer proceeds. A single upload can therefore be written without bound, far beyond the configured disk limit, until the node's disk is full, and because a server stopped for exceeding its limit is not treated as suspended, SFTP writes are still accepted even after the quota is already exceeded. This issue is fixed in version 1.13.3.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.7",
  "pubDate": "2026-08-26T22:16:25.247Z",
  "pubdate": "2026-08-26T22:16:25.247Z",
  "executiveSummary": "The Pterodactyl Wings server control plane is susceptible to a critical disk exhaustion vulnerability due to insufficient enforcement of storage quotas during SFTP file transfer operations.\nThe vulnerability allows an authenticated tenant with SFTP access to a single game server to bypass configured disk limits and write arbitrary amounts of data to the host node's physical storage.\nBy continuously writing data, an attacker can consume all available disk space on the host node, leading to a catastrophic denial-of-service (DoS) condition that affects all hosted instances on that node.\nThe flaw stems from the SFTP write path performing only a superficial, one-time check against stale cached usage data without accounting for the actual size of incoming data or performing ongoing validation during the transfer stream.\nThis vulnerability, present in Wings versions up to and including 1.13.3, presents a significant risk to service availability and system stability in multi-tenant hosting environments.\nSuccessful exploitation requires the attacker to have valid SFTP credentials for a managed server, but no additional privileges are needed to trigger the resource exhaustion.",
  "technicalDetails": "The vulnerability resides within the SFTP write handling mechanism of the Wings server control plane. When an SFTP client initiates a file transfer, the control plane performs an initial validation to verify if the disk quota has been exceeded. This validation is fundamentally flawed as it relies on a boolean check against a stale cached disk usage value, rather than an accurate, real-time calculation.\nFurthermore, the SFTP write path does not possess a mechanism to intercept or evaluate the total size of the incoming data stream before or during the write process. Once the initial check passes, Wings returns a raw, unaccounted file handle directly to the client. Because this file handle is not subject to any subsequent rate-limiting or boundary-checking logic, the underlying operating system continues to accept and commit data to the physical disk as long as the connection remains open and storage space remains available.\nThe attack flow is straightforward: an attacker authenticates via SFTP to a specific server instance. The attacker then initiates the upload of a large file or a continuous stream of data. Because the system fails to re-validate the quota as the file size grows, the application continues writing the data until the physical volume or partition of the host node is completely exhausted.\nNotably, the system's current logic for handling servers that have technically exceeded their disk limit fails to enforce a state of suspension for SFTP operations. Even if a server is flagged for being over its quota, the SFTP service remains operational and continues to accept write requests. This behavior allows a malicious actor to circumvent any protective measures that might be triggered by simple state-based monitoring.\nThe impact is severe; by exhausting the host node's disk space, the attacker inadvertently or intentionally triggers a node-wide failure. This impacts not only the attacker's assigned server but every other server sharing the same underlying disk storage, as they will be unable to write necessary state or log files, leading to a cascade of service failures and potential file system corruption across the entire platform."
}