{"id":"CVE-2026-52855","title":"Wings is the server control plane for Pterodactyl, a free, open-source game server management panel","summary":"Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.12.3, {{config.}} placeholders in egg configuration-file templates allow a low-privileged user to read {{config.token}}, {{co…","severity":"critical","cvss":9.9,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwe":["CWE-200","CWE-522"],"vendor":"pterodactyl","product":"github.com/pterodactyl/wings","affected":["github.com/pterodactyl/wings < 1.12.3"],"patched":["github.com/pterodactyl/wings 1.12.3"],"published":"2026-07-31","updated":"2026-09-10","sourceUpdated":"2026-09-10T20:12:43.783","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-52855","references":[{"url":"https://github.com/pterodactyl/wings/commit/eb65e27ae077a63e38518c490768486af1cd86a9","label":"security-advisories@github.com"},{"url":"https://github.com/pterodactyl/wings/releases/tag/v1.12.3","label":"security-advisories@github.com"},{"url":"https://github.com/pterodactyl/wings/security/advisories/GHSA-pfvc-3p5h-x7h6","label":"security-advisories@github.com"},{"url":"https://github.com/advisories/GHSA-pfvc-3p5h-x7h6"}],"tags":["nvd","ghsa","go"],"epss":0.0029,"epssPercentile":0.21782,"aliases":["GHSA-pfvc-3p5h-x7h6"],"ecosystem":"go","ingestedAt":"2026-07-31T17:00:00.144Z","slug":"CVE-2026-52855","body":"## Overview\n\nWings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.12.3, {{config.}} placeholders in egg configuration-file templates allow a low-privileged user to read {{config.token}}, {{config.token_id}}, and {{config.docker.registries}} from the full daemon configuration. This issue is fixed in version 1.12.3.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-52855)\n\nAffected packages:\n\n- `github.com/pterodactyl/wings < 1.12.3`\n\nPatched in:\n\n- `github.com/pterodactyl/wings 1.12.3`\n\nSource: https://github.com/advisories/GHSA-pfvc-3p5h-x7h6","depth":"midnight","depthScore":55,"depthScoreParts":{"impact":54.5,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}