CVE-2024-27102: Pterodactyl Wings Path Traversal Bug

CVE-2024-27102 Overview

CVE-2024-27102 is a path traversal vulnerability [CWE-22] in Pterodactyl Wings, the server control plane for Pterodactyl Panel. The flaw allows an attacker with an allocated server on a Wings instance to read files and directories outside the server's sandbox root on the host system. Exploitation requires an authenticated attacker who already controls a server managed by Wings. The vendor addressed the issue in version 1.11.9 through a full rewrite of the server filesystem implementation. No workarounds exist, and administrators must upgrade to remediate.

Critical Impact
Authenticated attackers with a controlled Wings server can escape the sandbox root and read arbitrary files on the host, exposing configuration data, credentials, and other tenant server contents.

Affected Products

Pterodactyl Wings versions prior to 1.11.9
Pterodactyl Panel deployments relying on affected Wings versions
Multi-tenant game server hosting environments using Pterodactyl

Discovery Timeline

2024-03-13 - CVE-2024-27102 published to NVD
2024-03-27 - Embargo lift date for exploitation details (per advisory)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-27102

Vulnerability Analysis

Pterodactyl Wings is the daemon that executes and manages game servers on host nodes for the Pterodactyl Panel. It enforces per-server sandboxing so that each tenant server can only access files within its designated base directory. CVE-2024-27102 breaks that isolation.

The vulnerability lets an attacker who owns a server allocated on Wings traverse outside the sandbox root and reach files and directories on the underlying host. The full scope of impact is not disclosed, but the vendor confirms out-of-sandbox file reads are possible. In multi-tenant hosting scenarios this can expose other tenants' server files, Wings configuration, and host credentials.

The scope-changed CVSS vector reflects that exploitation crosses the trust boundary from a sandboxed server context into the host filesystem.

Root Cause

The root cause lies in unsafe path handling within the Wings server filesystem layer. Path resolution and symlink handling did not consistently confine operations to the sandbox root, allowing crafted paths to escape it. The fix required a complete rebuild of the filesystem subsystem rather than a targeted patch, indicating the flaw was structural across multiple filesystem operations.

Attack Vector

An attacker must first control a server allocated within a Wings instance, typically through a legitimate Pterodactyl Panel account with server access. From that context, the attacker issues filesystem operations via Wings APIs using paths that resolve outside the sandbox root. Because Wings runs with privileges sufficient to manage all hosted servers, the traversal exposes host-level files.

// Security patch in config/config.go - server(filesystem): rebuild everything imaginable
 	"regexp"
 	"strings"
 	"sync"
+	"sync/atomic"
 	"text/template"
 	"time"
// Source: https://github.com/pterodactyl/wings/commit/d1c0ca526007113a0f74f56eba99511b4e989287

The patch replaces the prior directory-walking dependency and adds atomic primitives as part of the filesystem rewrite:

text

// Security patch in go.mod - dependency changes
 	github.com/iancoleman/strcase v0.3.0
 	github.com/icza/dyno v0.0.0-20230330125955-09f820a8d9c0
 	github.com/juju/ratelimit v1.0.2
-	github.com/karrick/godirwalk v1.17.0
+	github.com/klauspost/compress v1.17.7
 	github.com/klauspost/pgzip v1.2.6
// Source: https://github.com/pterodactyl/wings/commit/d1c0ca526007113a0f74f56eba99511b4e989287

Detection Methods for CVE-2024-27102

Indicators of Compromise

Wings API requests containing path components such as ../, absolute paths, or symlink references that resolve outside a server's base directory
Wings process accessing files outside expected server data roots (for example, /etc/pterodactyl, /root, other tenant directories)
Unexpected file read errors or successes in Wings logs referencing paths above the sandbox root

Detection Strategies

Audit Wings HTTP and websocket API logs for filesystem operations with suspicious path arguments and correlate to the requesting server UUID
Monitor host-level file access by the Wings process using auditd or eBPF-based file access monitoring, flagging reads outside configured server data directories
Compare running Wings version against 1.11.9 across all nodes and alert on any host still exposing vulnerable versions

Monitoring Recommendations

Enable verbose Wings logging and forward logs to a centralized SIEM or data lake for retention and correlation
Baseline normal filesystem access patterns per Wings node so traversal attempts stand out against tenant activity
Alert on any Wings archive, backup, or file-read operation that references paths outside the standard /var/lib/pterodactyl/volumes/<uuid> layout

How to Mitigate CVE-2024-27102

Immediate Actions Required

Upgrade every Wings node to version 1.11.9 or later, following the GitHub Security Advisory GHSA-494h-9924-xww9
Review Wings and host logs for prior evidence of path traversal against sensitive files and rotate any credentials that may have been exposed
Restrict Panel account creation and server allocation to trusted users until all nodes are patched

Patch Information

The vendor released Pterodactyl Wings 1.11.9 containing a full rewrite of the server filesystem to eliminate the traversal condition. The remediation is documented in the GitHub commit d1c0ca5 and the security advisory GHSA-494h-9924-xww9. The vendor states there are no known workarounds; upgrading is the only supported mitigation.

Workarounds

No vendor-supported workaround exists; only the upgrade to 1.11.9 remediates the issue
As a temporary risk-reduction measure, suspend untrusted tenant servers and disable file manager and backup features until nodes are patched
Isolate Wings nodes at the network layer so only the Panel can reach them, reducing exposure while upgrades are staged

bash

# Upgrade example on a Wings host (systemd-managed)
sudo systemctl stop wings
sudo curl -L -o /usr/local/bin/wings \
  "https://github.com/pterodactyl/wings/releases/download/v1.11.9/wings_linux_amd64"
sudo chmod u+x /usr/local/bin/wings
/usr/local/bin/wings --version   # verify 1.11.9 or later
sudo systemctl start wings