CVE-2025-53908
RomM vulnerable to Authenticated Path Traversal
- State
- Published
- Severity
- 8.3 High
- Published
- Jul 16, 2025
- Updated
- Jul 18, 2025
- Reserved
- Jul 11, 2025
Description
RomM is a self-hosted rom manager and player. Versions prior to 3.10.3 and 4.0.0-beta.3 have an authenticated path traversal vulnerability in the `/api/raw` endpoint. Anyone running the latest version of RomM and has multiple users, even unprivileged users, such as the kiosk user in the official implementation, may be affected. This allows the leakage of passwords and users that may be stored on the system. Versions 3.10.3 and 4.0.0-beta.3 contain a patch.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.3 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N | GitHub_M |
Weaknesses
- CWE-26 Path Traversal: '/dir/../filename'
Affected Products
| Product | Versions |
|---|---|
rommrommapp |
|
References
- https://github.com/rommapp/romm/security/advisories/GHSA-fx9g-xw4j-jwc3
- https://github.com/rommapp/romm/commit/7c94cb05e74ddb6a6af7b82320686c01754e9966
- https://github.com/rommapp/romm/commit/baa1a9759079c36e36a9f10c920c46b57d0b6151
- https://github.com/rommapp/romm/blob/4.0.0-beta.2/backend/endpoints/raw.py#L31
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.