TL;DR: Pterodactyl Wings, the daemon component of the Pterodactyl game server management panel, exposes its full daemon configuration to the egg configuration-file templating engine. Any {{config.<path>}} placeholder in an egg replacement value resolves against the complete marshalled daemon config. Attackers who can influence egg templates can extract API keys, SFTP credentials, and database connection strings. CVSS 9.9. Fixed in Wings 1.12.3.

Why it matters

Pterodactyl is a widely used game server management platform. Wings is the daemon that runs on each game server node, handling server lifecycle, file management, and resource allocation. The daemon configuration contains the API key for communicating with the panel, SFTP credentials, database connection strings, and system paths.

If an attacker extracts the daemon API key, they can impersonate the node to the panel. They can upload files, execute commands on the node, and potentially pivot to other nodes in the same Pterodactyl deployment. CVSS 9.9 reflects this: the vulnerability requires low attack complexity, needs no privileges, and has high confidentiality and integrity impact.

What happened

When Wings renders a server's configuration files, it processes {{config.<path>}} placeholders by resolving them against the full marshalled daemon configuration. There is no restriction on which paths may be read. The Panel substitutes egg variables into server configuration files, and any egg that includes a {{config.*}} reference in a replacement value triggers the leak.

The exposure is broad. The daemon configuration is a single struct, and every field is accessible through the templating engine. An attacker who can create or modify egg templates (or influence the replacement values) can read arbitrary configuration fields by referencing them in a template.

Who is affected

Any Pterodactyl deployment running Wings before version 1.12.3. Game hosting providers using Pterodactyl should treat this as a priority update.

What to do

Update Wings to version 1.12.3:

systemctl stop wings
cd /etc/pterodactyl
curl -L -o wings.jar https://github.com/pterodactyl/wings/releases/download/v1.12.3/wings_linux_amd64
chmod +x wings.jar
systemctl start wings

After updating, rotate the daemon API key and any credentials that may have been exposed. Check panel audit logs for suspicious egg template modifications.

References

• GitHub Security Advisory GHSA-pfvc-3p5h-x7h6
• Wings v1.12.3 release
• hol.org CVE entry