Log in Start free

Vulnerability · Published Jul 28, 2026 · Assigned by GitHub_M

CVE-2026-54593Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions

High 8.1

In plain English

A high-severity security flaw in panel from pterodactyl. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.1High
Exploit odds (30 days)0.7%top 47.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

Pterodactyl is a free, open-source game server management panel. Prior to Panel version 1.12.3 and Wings version 1.12.2, the Wings /upload/file endpoint accepted any valid panel-signed JWT that contained server_uuid, user_uuid, and unique_id claims without checking the token's intended purpose; because the Panel issues JWTs carrying those same claims for lower-privilege operations such as WebSocket authentication and file-download links, an authenticated subuser could reuse one of those tokens (for example a WebSocket token obtained with only the websocket.connect permission) by replaying it against /upload/file to write arbitrary files to the same server, despite never being granted the file.create permission. This issue is fixed in Panel version 1.12.3 and Wings version 1.12.2.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Gogithub.com/pterodactyl/wings1.12.2GO-2026-6120
Gogithub.com/pterodactyl/wings1.12.2GHSA-8r6w-3qq5-4p4r
Packagistpterodactyl/panel1.12.3GHSA-8r6w-3qq5-4p4r

Affected products (as reported)

VendorProductVersions
pterodactyl panel < 1.12.3

Weakness: CWE-1259, CWE-1270 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

References