CVE-2025-58448
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
rAthena prior to commit 0d89ae0 has a SQL Injection in the PartyBooking component via the WorldName parameter. Commit 0d89ae0 fixes the issue.
Risk Assessment
An attacker could execute unauthorized database queries, potentially leading to leakage or modification of game server data. This may harm the integrity and confidentiality of player data.
Recommendation
Update rAthena to a version containing commit 0d89ae0 or later. Until then, restrict access to the PartyBooking functionality.
Other vulnerabilities in rAthena
See all- CVE-2025-58447Critical
In rAthena versions prior to commit 2f5248b, a heap-based buffer overflow exists in the login server; a remote attacker can overwrite adjacent session fields by sending a crafted CA_SSO_LOGIN_REQ with an oversized token length. This leads to immediate denial of service (crash) and remote code execution is possible via heap corruption. Commit 2f5248b fixes the issue.
- CVE-2025-62170High
In rAthena versions prior to commit af2f3ba, a use-after-free vulnerability exists in the RODEX functionality of the map-server. An unauthenticated attacker can exploit this in a specific attack scenario to cause a denial of service by crashing the map-server.
- CVE-2025-58750High
rAthena is an open-source cross-platform MMORPG server. Versions prior to commit 0cc348b are missing a bound check in chclif_parse_moveCharSlot that can result in reading and writing out of bounds using input from the user.
Original NVD description (English source)
rAthena is an open-source cross-platform massively multiplayer online role playing game (MMORPG) server. Versions prior to commit 0d89ae0 have a SQL Injection in the PartyBooking component via `WorldName` parameter. Commit 0d89ae0 fixes the issue.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS