CVE-2025-68954Published

Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced

cve-program · CVE-2025-68954

Published

panel

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "pterodactyl",
                    "product": "panel",
                    "versions": [
                        {
                            "version": "<  1.12.0",
                            "status": "affected"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON

euvd · EUVD-2026-1041

Published

EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON.

Original publisher date fields

datePublished: Jan 6, 2026, 12:31:14 AM

dateUpdated: Jan 6, 2026, 7:01:17 PM

No normalized affected-package data is projected for this source revision. The original publisher record may contain additional product and version evidence; this does not establish that a package is unaffected.

Original source record · Cite this exact observation · Complete original publisher JSON

nvd · CVE-2025-68954

Published

NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON.

Source analysis status: Analyzed

Weakness classifications: CWE-613

Original publisher date fields

published: 2026-01-06T01:16:01.387

lastModified: 2026-10-07T10:10:00.213

2 source CPE criteria · context only

cpe:2.3:a:pterodactyl:panel:*:*:*:*:*:*:*:*
cpe:2.3:a:pterodactyl:wings:*:*:*:*:*:*:*:*

The original JSON retains the logical configuration operators, exclusions and version bounds.

Original source record · Cite this exact observation · Complete original publisher JSON

osv · GHSA-8c39-xppg-479c

Published

pterodactyl/panel

Packagist

ECOSYSTEM · introduced 0 → fixed 1.12.0

118 explicitly affected versions

v0.1.0-beta, v0.1.1-beta, v0.1.2-beta, v0.2.0-beta, v0.3.0-beta, v0.4.0-beta, v0.4.1-beta, v0.5.0, v0.5.0-rc.1, v0.5.0-rc.2, v0.5.1, v0.5.2, v0.5.3, v0.5.4, v0.5.5, v0.5.6, v0.5.7, v0.6.0, v0.6.0-beta.1, v0.6.0-beta.2, v0.6.0-beta.2.1, v0.6.0-rc.1, v0.6.1, v0.6.2, v0.6.3, v0.6.4, v0.7.0, v0.7.0-beta.1, v0.7.0-beta.2, v0.7.0-beta.3, v0.7.0-beta.4, v0.7.0-rc.1, v0.7.0-rc.2, v0.7.1, v0.7.10, v0.7.11, v0.7.12, v0.7.13, v0.7.14, v0.7.15, v0.7.16, v0.7.17, v0.7.18, v0.7.19, v0.7.2, v0.7.3, v0.7.4, v0.7.5, v0.7.6, v0.7.7, v0.7.8, v0.7.9, v0.8.0-alpha.1, v0.8.0-alpha.2, v1.0.0, v1.0.0-beta.1, v1.0.0-beta.2, v1.0.0-beta.3, v1.0.0-beta.4, v1.0.0-beta.5, v1.0.0-beta.6, v1.0.0-beta.7, v1.0.0-rc.1, v1.0.0-rc.2, v1.0.0-rc.3, v1.0.0-rc.4, v1.0.0-rc.5, v1.0.0-rc.6, v1.0.0-rc.7, v1.0.1, v1.0.2, v1.0.3, v1.1.0, v1.1.1, v1.1.2, v1.1.3, v1.10.0, v1.10.1, v1.10.2, v1.10.3, v1.10.4, v1.11.0, v1.11.0-rc.1, v1.11.0-rc.2, v1.11.1, v1.11.10, v1.11.11, v1.11.2, v1.11.3, v1.11.4, v1.11.5, v1.11.6, v1.11.7, v1.11.8, v1.11.9, v1.2.0, v1.2.1, v1.2.2, v1.3.0, v1.3.1, v1.3.2, v1.4.0, v1.4.1, v1.4.2, v1.5.0, v1.5.1, v1.6.0, v1.6.1, v1.6.2, v1.6.3, v1.6.5, v1.6.6, v1.7.0, v1.8.0, v1.8.1, v1.9.0, v1.9.1, v1.9.2

github.com/pterodactyl/wings

SEMVER · introduced 0 → fixed 1.12.0

Original source record · Cite this exact observation · Complete original publisher JSON

osv · GO-2026-4283

Published

github.com/pterodactyl/wings

SEMVER · introduced 0 → fixed 1.12.0

Original source record · Cite this exact observation · Complete original publisher JSON