rAthena vulnerabilities
We track 5 vulnerabilities in rAthena products across 2 products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on October 29, 2025.
Latest rAthena vulnerabilities
- 8.6 High severity
FluxCP: Cross-Site Request Forgery
FluxCP is a web-based Control Panel for rAthena servers written in PHP. A critical Cross-Site Request Forgery (CSRF) vulnerability exists in the FluxCP-based website template used by multiple rAthena/Ragnarok servers. State-changing POST endpoints accept brows
- 7.5 High severity
rathena: Use After Free
rAthena is an open-source cross-platform MMORPG server. A use-after-free vulnerability exists in the RODEX functionality of rAthena's map-server in versions prior to commit af2f3ba. An unauthenticated attacker can exploit this vulnerability via a specific atta
- 9.1 Critical severity
rathena: Out-of-bounds Read
rAthena is an open-source cross-platform massively multiplayer online role playing game (MMORPG) server. Versions prior to commit 0cc348b are missing a bound check in `chclif_parse_moveCharSlot` that can result in reading and writing out of bounds using input
- 9.8 Critical severity
rathena: Improper Neutralization of Special Elements used in an SQL Command
rAthena is an open-source cross-platform massively multiplayer online role playing game (MMORPG) server. Versions prior to commit 0d89ae0 have a SQL Injection in the PartyBooking component via `WorldName` parameter. Commit 0d89ae0 fixes the issue.
- 9.8 Critical severity
rathena: Out-of-bounds Write
rAthena is an open-source cross-platform massively multiplayer online role playing game (MMORPG) server. Versions prior to commit 2f5248b have a heap-based buffer overflow in the login server, remote attacker to overwrite adjacent session fields by sending a c