CVE-2025-68954 Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced

What is CVE-2025-68954?

CVE-2025-68954 is a high-severity vulnerability in pterodactyl panel, published on 6 Jan 2026.

Official description

Pterodactyl is a free, open-source game server management panel. Versions 1.11.11 and below do not revoke active SFTP connections when a user is removed from a server instance or has their permissions changes with respect to file access over SFTP. This allows a user that was already connected to SFTP to remain connected and access files even after their permissions are revoked. A user must have been connected to SFTP at the time of their permissions being revoked in order for this vulnerability to be exploited. This issue is fixed in version 1.12.0.

Weakness: CWE-613

Which versions are affected by CVE-2025-68954?

5 open source packages ship an affected version, including pterodactyl/panel and github.com/pterodactyl/wings. It affects 2 products.

Products include Pterodactyl Panel, Pterodactyl Wings.

How do I fix CVE-2025-68954?

Upgrade pterodactyl/panel to 1.12.0 or later.

Is CVE-2025-68954 being exploited?

There is no known exploitation of CVE-2025-68954 in the wild and no public exploit code.

Other vulnerabilities in pterodactyl panel

• CVE-2026-26016 Pterodactyl Panel Allows Cross-Node Server Configuration Disclosure via Remote API Missing Authorization Critical 9.2
• CVE-2021-41129 Authentication bypass in Pterodactyl High 8.1
• CVE-2019-1020002 Pterodactyl vulnerable to 2FA Sniffing High 7.5
• CVE-2025-69197 Pterodactyl TOTPs can be reused during validity window Medium 6.5
• CVE-2024-34067 Multiple cross site scripting (XSS) vulnerabilities in the admin area of Pterodactyl panel Medium 6.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-8c39-xppg-479c, GO-2026-4283.