CVE-2024-34067mediumCWE-79

CVE-2024-34067: medium-severity vulnerability in pterodactyl panel

Multiple cross site scripting (XSS) vulnerabilities in the admin area of Pterodactyl panel

Published · Updated

Follow this CVE+ Monitor panel+ Monitor pterodactyl/panel

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.1epss 0.5%
Pterodactyl is a free, open-source game server management panel built with PHP, React, and Go. Importing a malicious egg or gaining access to wings instance could lead to cross site scripting (XSS) on the panel, which could be used to gain an administrator account on the panel. Specifically, the following things are impacted: Egg Docker images and Egg variables: Name, Environment variable, Default value, Description, Validation rules. Additionally, certain fields would reflect malicious input, but it would require the user knowingly entering such input to have an impact. To iterate, this would require an administrator to perform actions and can't be triggered by a normal panel user. This issue has has been addressed in version 1.11.6 and users are advised to upgrade. No workaround is available other than updating to the latest version of the panel.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected products
pterodactyl · panel
Related CVEs — pterodactyl panel

In the same product, most dangerous first.

CVE-2025-49132CRITICALPterodactyl Panel Allows Unauthenticated Arbitrary Remote Code ExecutionEPSS 54.5%CVE-2021-41129HIGHAuthentication bypass in PterodactylEPSS 1.8%CVE-2026-54593HIGHPterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissionsEPSS 0.7%CVE-2026-86177HIGHPterodactyl Panel before 1.14.1 Privilege Escalation via Schedule TasksEPSS 0.6%CVE-2021-41176MEDIUMlogout CSRF in Pterodactyl PanelEPSS 0.5%CVE-2026-61609HIGHPterodactyl's shared global rate-limit key on login and 2FA checkpoint enables unauthenticated panel-wide authentication lockout (DoS)EPSS 0.5%