CVE-2026-52856

{
  "id": "CVE-2026-52856",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-31T17:16:33.460",
  "lastModified": "2026-10-23T23:10:00.157",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.13.0, a malformed packet received during the SFTP connection handshake causes a Go panic. This issue is fixed in version 1.13.0."
    },
    {
      "lang": "es",
      "value": "Wings es el plano de control del servidor para Pterodactyl, un panel de gestión de servidores de juegos gratuito y de código abierto. Antes de la versión 1.13.0, un paquete malformado recibido durante el handshake de la conexión SFTP causa un pánico de Go. Este problema está solucionado en la versión 1.13.0."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "pterodactyl",
          "product": "wings",
          "versions": [
            {
              "version": "< 1.13.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-31T18:57:27.226859Z",
          "id": "CVE-2026-52856",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-129"
        },
        {
          "lang": "en",
          "value": "CWE-248"
        },
        {
          "lang": "en",
          "value": "CWE-617"
        },
        {
          "lang": "en",
          "value": "CWE-755"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/pterodactyl/wings/commit/8e49c7c0eda815d3ada171831876a1c14c493026",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/pterodactyl/wings/releases/tag/v1.13.0",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/pterodactyl/wings/security/advisories/GHSA-ghrq-5wpp-hxx5",
      "source": "[email protected]"
    }
  ]
}