Pterodactyl panel's admin area vulnerable to Cross-site Scripting

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS

6.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

• CVE-2024-34067: 0.46% estimated exploitation activity in the next 30 days; percentile 39.71 (FIRST EPSS, 2026-11-03). This is a model estimate, not proof of exploitation or customer exposure.

As published by the source; long descriptions are shortened.

Impact Importing a malicious egg or gaining access to wings instance could lead to XSS on the panel, which could be used to gain an administrator account on the panel. Specifically, the following things are impacted: - Egg Docker images - Egg variables: - Name - Environment variable - Default value - Description - Validation rules Additionally, certain fields would reflect malicious input, but it would require the user knowingly entering such input to have an impact. To iterate, this would require an administrator to perform actions and can't be triggered by a normal panel user. Workarounds No workaround is available other than updating to the latest version of the panel. Patches All of the following commits are required to resolve this security issue: https://github.com/pterodactyl/panel/commit/1172d71d31561c4e465dabdf6b838e64de48ad16 https://github.com/pterodactyl/panel/commit/f671046947e4695b5e1c647df79305c1cefdf817…

Published by the source

3 May 2024, 20:29 UTC

Last modified by the source

3 May 2024, 20:29 UTC

Source last checked

26 Oct 2026, 14:24 UTC

1. Revision 1 · created · 26 Oct 2026

   Published from ghsa record GHSA-384w-wffr-x63q

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: CVE-2024-34067

Advisory: Pterodactyl panel's admin area vulnerable to Cross-site Scripting
IDs: CVE-2024-34067, GHSA-384w-wffr-x63q
Record: https://patchnext.com/advisories/cve-2024-34067 (revision 1, source checked 26 Oct 2026, 14:24 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: Medium (CVSS 6.1)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Vendor fix available; fixed versions by package: pterodactyl/panel 1.11.6. A vendor fix does not mean a deployment is fixed.

## Affected components
- Packagist pterodactyl/panel: affected < 1.11.6; fixed in 1.11.6

## Suggested inspection (read-only)
- Packagist pterodactyl/panel: check the installed version with your package manager.

## Supported action
Upgrade each affected component to a fixed version on its release line. For a transitive dependency, upgrade the parent package or add an override or constraint, then regenerate the lockfile. Redeploy every environment that ran an affected version.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on pterodactyl/panel.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://github.com/advisories/GHSA-384w-wffr-x63q (GitHub-reviewed advisory GHSA-384w-wffr-x63q lists affected ranges: Packagist pterodactyl/panel >=0 <1.11.6)

Commands are suggestions: review each one before running it.