Wings, the server‑control plane of Pterodactyl, fails to account for SQLite’s maximum parameter limit when deleting processed activity logs. When the delete query attempts to delete more than 32,766 entries, SQLite returns an error and no entries are removed. Those entries are then repeatedly re‑processed and sent to the panel each cron run. An attacker with low privileges can cause this condition, leading to an ever‑growing stream of duplicated activity records and eventual disk exhaustion on the panel’s database server. The weakness lies in resource exhaustion (CWE‑770) and inadequate validation of operation size (CWE‑400).

Product: Pterodactyl Wings – the Wings component of the Pterodactyl game‑server management panel. Affected releases include all versions from 1.7.0 up to, but not including, 1.12.0; any deployment of Wings in this range is susceptible.

The CVSS score of 8.3 indicates a high severity vulnerability, while the EPSS score of less than 1% suggests a currently low probability of exploitation. The attack vector requires only a low‑privileged user on the Wings instance, and the vulnerability can be exploited by causing the cron job to repeatedly attempt a delete query that exceeds SQLite’s parameter limit—triggering a logic error that leaves the logs undeleted. The result is persistent re‑upload of the same data until disk space is exhausted. This vulnerability is not listed in the CISA KEV catalog, but its severity warrants prompt remediation.