The vulnerability lies in Wings, the Pterodactyl control plane, where the SFTP write path ignores the server’s disk quota. When a tenant uploads a file, the system checks disk availability only once at the start, using a stale cache and not knowing the file size. The resulting write handle is never re‑checked, allowing an upload to grow unchecked until the node’s disk is full. Because a server that has exceeded its quota is not treated as suspended, uploads continue to be accepted even after the limit is reached, leading to a complete disk exhaustion that can bring down every server on the host node. This results in denial of service for all tenants on the affected node.

Pterodactyl Wings versions 1.13.2 and earlier, which provide the server control plane for game‑server management. The issue is fixed starting with version 1.13.3, so any installation of Wings with a version <= 1.13.2 is affected.

The CVSS score of 7.7 indicates a high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, but its impact is large if exploited. The likely attack vector is an SFTP write from a tenant with access to a server. Because the flaw allows unlimited data transfer, an attacker who can initiate an SFTP upload can consume disk space on the node until it becomes full, thereby disrupting all servers.