Pterodactyl's game server panel allows an authenticated subuser to exploit a JWT scoping flaw that lets them upload arbitrary files to a server. By replaying a lower‑privilege JWT that contains the necessary server and user identifiers, a subuser can create or overwrite files on the hosting machine without having the explicit file.create permission, potentially enabling code execution or data tampering.

The vulnerability affects Pterodactyl Panel versions earlier than 1.12.3 and Wings versions earlier than 1.12.2. Any instance using these older releases is susceptible if subusers receive a JWT issued for websocket or file‑download use cases.

With a CVSS score of 8.1 the flaw is considered high severity, yet its EPSS score of less than 1% indicates a low likelihood of immediate exploitation. The vulnerability is not listed in the CISA KEV catalog. Successful exploitation requires possession of a valid panel‑signed JWT for a target server; an attacker can replay that token against the /upload/file endpoint to write files. Because the flaw does not require local access and can be triggered over the network, it represents a remote attack vector that could lead to code execution or privilege escalation on the server.