Pterodactyl is a free, open-source game server management panel. Prior to Panel version 1.12.3 and Wings version 1.12.2, the Wings /upload/file endpoint accepte…

CVE-2026-54593 affects Pterodactyl, a free open-source game server management panel. Prior to Panel version 1.12.3 and Wings version 1.12.2, the Wings /upload/file endpoint failed to validate the intended purpose of panel-signed JWTs. Because JWTs issued for lower-privilege operations (e.g., WebSocket authentication, file-download links) contained the same claims (server_uuid, user_uuid, unique_id) as higher-privilege tokens, an authenticated subuser could replay a lower-privilege token against the /upload/file endpoint. This allowed arbitrary file writes to a server without possessing the file.create permission, constituting a privilege escalation and authorization bypass vulnerability. The flaw is classified as a JWT token reuse/confused deputy attack. Fixes have been released in Panel version 1.12.3 and Wings version 1.12.2. Users are advised to update immediately to mitigate unauthorized file write risks.