Skip to content
OpenAdvisories
Critical · 9.1 CVE-2025-58448 EUVD-2025-34019

rAthena has SQL Injection in PartyBooking component via `WorldName` parameter.

Published Sep 9, 2025 · Updated Sep 10, 2025 · Assigned by GitHub_M

Description

rAthena is an open-source cross-platform massively multiplayer online role playing game (MMORPG) server. Versions prior to commit 0d89ae0 have a SQL Injection in the PartyBooking component via `WorldName` parameter. Commit 0d89ae0 fixes the issue.

Affected products

VendorProductAffectedFixed
rathena rathena < 0d89ae0 —

References