github.com/pterodactyl/wings

Full Changelog: v1.13.0...v1.13.1

What's Changed

• Only set the container block IO weight when the host supports io.weight by @robertdrakedennis in #324
• empty folders in uploaded artifacts should be preserved by @robertdrakedennis in #325
• fix: Directories created via panel are owned by root:root by @SkyMulley in #328

New Contributors

• @robertdrakedennis made their first contribution in #324
• @SkyMulley made their first contribution in #328

Full Changelog: v1.12.3...v1.13.0

Full Changelog: v1.12.2...v1.12.3

Fixed

• Fixes a bug where fs.Chmod would change the symlink target possibly allowing a malicious user to modify files outside their home directory.
• Improved error handling when downloading files to not log as a 500-level error, preferring a 400-level response.
• Fixes JWT verification logic to confirm that the token has the required scopes for the target subsystem.

Added

• Add mount for /etc/machine-id for servers for Hytale (#292)

Fixed

• CVE-2025-68954
• CVE-2025-69199
• CVE-2026-21696
• Fixes folders not being sorted before files when returning list of directory contents (#5078)
• User-defined labels not being passed to environment (#191)
• Fixes handling of termination signals for containers (#192)
• Fixes logic to use base2 (1024, *bibyte) when calculating memory limits (#190)
• Fixes hard-links being counted multiple times when calculating disk usage (#181)

Added

• Support relative file paths for the Wings config (#180)
• Support mounting generated /etc/passwd files to containers (#197)

Fixed

• Auto-configure not working (#5087)
• Individual files unable to be decompressed (#5034)

SHA256 Checksum

aca5fa45ddf1c10f092c16dd758b920d8a3fa9f91c37aacc62745e72958bf71a  wings_linux_amd64
a3d71e8c67e261fdd287f73dcab98d2a55dbba9ce001794e0006e4ed88fafe6a  wings_linux_arm64

Fixed

• Arbitrary File Write/Read (GHSA-gqmf-jqgv-v8fw)
• Server-side Request Forgery (SSRF) during remote file pull (GHSA-qq22-jj8x-4wwv)
• Invalid Content-Type being used with the wings diagnostics command (#186)

SHA256 Checksum

4bcbd3a71bed9afed37d132980ac553e4bd39a38b5ae53c477d02933746de856  wings_linux_amd64
af5582e05a34228e9ff423ee982fedddf96e374f243fd2bfa0fe42083f821bdf  wings_linux_arm64

Fixed

• Backups missing content when a .pteroignore file is used
• Archives originating from a subdirectory not containing any files (#5030)

Fixed

• Archives randomly ignoring files and directories (#5027)
• Crash when deleting or transferring a server (#5028)

Changed

• Release binaries are now built with Go 1.21.8
• Updated Go dependencies

Fixed

• CVE-2024-27102

Changed

• Release binaries are now built with Go 1.20.10 (resolves CVE-2023-44487)
• Updated Go dependencies

Changed

• Updated Go dependencies (this resolves an issue related to http: invalid Host header with Docker)
• Wings is now built with go1.19.11

Fixed

• CVE-2023-32080

Added

• Added a config option to disable Wings config.yml updates from the Panel (https://github.com/pterodactyl/wings/commit/ec6d6d83ea3eb14995c24f001233e85b37ffb87b)

Changed

• Wings is now built with Go 1.19.7

Fixed

• Fixed archives containing partially matched file names (https://github.com/pterodactyl/wings/commit/43b3496f0001cec231c80af1f9a9b3417d04e8d4)

Fixed

• CVE-2023-25168

Fixed

• CVE-2023-25152

Fixed

• Backups being restored from remote storage (s3) erroring out due to a closed stream.
• Fix IP validation logic for activity logs filtering out valid IPs instead of invalid IPs

Changed

• Release binaries are now built with Go 1.18.10
• Timeout when stopping a server before a transfer begins has been reduced to 15 seconds from 1 minute
• Removed insecure SSH protocols for use with the SFTP server

Fixed

• Unnecessary Docker client connections being left open, causing a slow leak of file descriptors
• Files being left open in parts of the server's filesystem, causing a leak of file descriptors
• IPv6 addresses being corrupted by flawed port stripping logic for activity logs, old entries with malformed IPs will be deleted from the local SQLite database automatically
• A server that times out while being stopped at the beginning of a transfer no longer causes the server to become stuck in a transferring state

Added (since 1.7.2)

• More detailed information returned by the /api/system endpoint when using the ?v=2 query parameter.

Changed (since 1.7.2)

• Send re-installation status separately from installation status.
• Wings release versions will now follow the major and minor version of the Panel.
• Transfers no longer buffer to disk, instead they are fully streamed with only a small amount of memory used for buffering.
• Release binaries are no longer compressed with UPX.
• Use POST instead of GET for sending the status of a transfer to the Panel.

Fixed (since 1.7.2)

• Fixed servers outgoing IP not being updated whenever a server's primary allocation is changed when using the Force Outgoing IP option.
• Fixed servers being terminated rather than gracefully stopped when a signal is used to stop the container rather than a command.
• Fixed file not found errors being treated as an internal error, they are now treated as a 404.
• Wings can be run with Podman instead of Docker, this is still experimental and not recommended for production use.
• Archive progress is now reported correctly.
• Labels for containers can now be set by the Panel.
• Fixed servers becoming deadlocked when the target node of a transfer goes offline.

Added

• More detailed information returned by the /api/system endpoint when using the ?v=2 query parameter.

Changed

• Send reinstallation status separately from installation status.

Fixed

• Fixed servers outgoing IP not being updated whenever a server's primary allocation is changed when using the Force Outgoing IP option.
• Fixed servers being terminated rather than gracefully stopped when a signal is used to stop the container rather than a command.
• Fixed file not found errors being treated as an internal error, they are now treated as a 404.

Changed

• Wings release versions will now follow the major and minor version of the panel.
• Transfers no longer buffer to disk, instead they are fully streamed with only a small amount of memory used for buffering.
• Release binaries are no longer compressed with UPX.

Fixed

• Wings can be run with podman instead of Docker, this is still experimental and not recommended for production use.
• Archive progress is now reported correctly.
• Labels for containers can now be set by the Panel.

Fixed

• CVE-2023-32080

Fixed

• CVE-2023-25168

Fixed

• CVE-2023-25152

Fixed

• The S3 backup driver now supports Cloudflare R2

Added

• During a server transfer, there is a new "Archiving" status that outputs the progress of creating the server transfer archive.
• Adds a configuration option to control the list of trusted proxies that can be used to determine the client IP address.
• Adds a configuration option to control the Docker username space setting when Wings creates containers.

Changed

• Releases are now built using Go 1.18 — the minimum version required to build Wings is now Go 1.18.

Fixed

• YAML parser has been updated to fix some strange issues

Added

• Added Force Outgoing IP option for servers to ensure outgoing traffic uses the server's IP address
• Adds an option to control the level of gzip compression for backups

Fixed

• Fixes multi-platform support for Wings' Docker image.

Added

• Adds support for tracking of SFTP actions, power actions, server commands, and file uploads by utilizing a local SQLite database and processing events before sending them to the Panel.
• Adds support for configuring the MTU on the pterodactyl0 network.