CVE-2025-58448 is a critical (CVSS 9.1) SQL injection in rAthena, the open source MMORPG server. The PartyBooking component mishandles the WorldName parameter in builds before commit 0d89ae0. The fix is that commit, so pull the latest source, rebuild and restart your servers.
What's affected
rAthena builds before commit 0d89ae0, per the record and the GitHub advisory.
The fix is commit 0d89ae0. The project identifies the fix by commit rather than by a release number.
The affected component is PartyBooking, and the parameter is WorldName.
How to check if you're exposed
rAthena has no version number to compare. Fixes are identified by commit. In your clone, test whether the fix commit is already part of your build.
git fetch origin
git merge-base --is-ancestor 0d89ae0 HEAD && echo patched || echo not patched
If you run a build from a packaged archive, compare the date of your snapshot with the fix commit date on GitHub. Also confirm who can reach the server ports: game servers are usually exposed to the internet on purpose.
What to do now
- Pull the latest rAthena source so that it includes commit 0d89ae0, then rebuild and restart your servers.
- Run the game database account with the minimum privileges it needs, and keep it separate from other databases.
- Back up the database and review account and item tables for changes you cannot explain.
- Rate limit and monitor connections to the server ports.
- Run the application's database account with only the privileges it needs, and keep it away from other schemas.
- Log and alert on database errors coming from the web tier, since probing often shows up as a burst of malformed requests.
Why it matters
The server used the WorldName value in a database query without making it safe first. A player controlled string reaching a query is the classic setup for injection. Game servers often store account details and passwords in the same database as game state, which raises the stakes.
The CVSS vector shows confidentiality and integrity impact with no privileges needed, which matches a public game server where anyone can connect.
The record classifies the weakness as CWE-89 (SQL Injection).
SQL injection happens when text from a request is placed into a database query as if it were part of the query itself. The database cannot tell the developer's instructions from the visitor's input, so a crafted value can change what the query does. The standard fix is a parameterized query, where the values travel separately from the statement.
For defenders the useful question is what the database account behind the application is allowed to do. A web user with read and write access to every table turns one flawed parameter into a full data exposure. A narrow account limits the damage while the code is being corrected.
The record shows this CVE is not in the CISA Known Exploited Vulnerabilities catalog.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
How do I know my build is fixed?
Check that commit 0d89ae0 is in your history, for example with the merge-base ancestor check in git, then rebuild.
Is there a release number?
The advisory identifies the fix by commit, not by a version number.
Sources
Last reviewed: 18 October 2026.
