CVE-2025-62797

HighCVSS 8.6

Published: 29/10/2025(UTC)Updated: 08/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.20%

9th percentile - higher than 9% of all known CVEs

Summary

Critical CSRF vulnerability in FluxCP, a web-based control panel for rAthena servers. State-changing POST requests are authorized solely by session cookie without anti-CSRF tokens or robust Origin/Referer validation. An attacker can lure a logged-in user to perform sensitive actions unintentionally.

Risk Assessment

A user can be tricked into performing sensitive actions without their consent, potentially leading to data integrity issues or unauthorized changes.

Recommendation

Update FluxCP to a version containing commit e3f130c and implement CSRF protections.

Other vulnerabilities in FluxCP

CVE-2026-116254Medium
In rathena FluxCP up to 98cd4b8fd83228c11b36fb3d097b8e0f7c105a8d, the verifyiprange function in lib/Flux/PaymentNotifyRequest.php (PayPal IPN Handler component) allows an origin validation error via manipulation of the X-Real-IP argument. The attack can be carried out remotely and the exploit is publicly available. The vendor was contacted but did not respond.

Original NVD description (English source)

FluxCP is a web-based Control Panel for rAthena servers written in PHP. A critical Cross-Site Request Forgery (CSRF) vulnerability exists in the FluxCP-based website template used by multiple rAthena/Ragnarok servers. State-changing POST endpoints accept browser-initiated requests that are authorized solely by the session cookie without per-request anti-CSRF tokens or robust Origin/Referer validation. An attacker who can lure a logged-in user to an attacker-controlled page can cause that user to perform sensitive actions without their intent. This vulnerability is fixed with commit e3f130c.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS