CVE-2025-62797: CSRF in FluxCP account endpoints allows account takeover / state-changing actions
FluxCP is a web-based Control Panel for rAthena servers written in PHP. A critical Cross-Site Request Forgery (CSRF) vulnerability exists in the FluxCP-based website template used by multiple rAthena/Ragnarok servers. State-changing POST endpoints accept browser-initiated requests that are authorized solely by the session cookie without per-request anti-CSRF tokens or robust Origin/Referer validation. An attacker who can lure a logged-in user to an attacker-controlled page can cause that user to perform sensitive actions without their intent. This vulnerability is fixed with commit e3f130c.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-62797?
CVE-2025-62797 is classified as a critical vulnerability due to its potential for Cross-Site Request Forgery attacks.
How do I fix CVE-2025-62797?
To fix CVE-2025-62797, it is recommended to apply security patches provided by the FluxCP developers and enhance CSRF protection measures.
Which software is affected by CVE-2025-62797?
CVE-2025-62797 affects the FluxCP web-based Control Panel utilized by multiple rAthena/Ragnarok servers.
What types of attacks can CVE-2025-62797 enable?
CVE-2025-62797 can enable Cross-Site Request Forgery attacks that may allow unauthorized actions performed on behalf of a user.
When was CVE-2025-62797 disclosed?
CVE-2025-62797 was disclosed in 2025, indicating a serious security concern for users of the affected software.