Description

RomM is a self-hosted rom manager and player. Versions prior to 3.10.3 and 4.0.0-beta.3 have an authenticated path traversal vulnerability in the `/api/raw` endpoint. Anyone running the latest version of RomM and has multiple users, even unprivileged users, such as the kiosk user in the official implementation, may be affected. This allows the leakage of passwords and users that may be stored on the system. Versions 3.10.3 and 4.0.0-beta.3 contain a patch.

INFO

Published Date :

2025-07-16T19:55:15.844Z

Last Modified :

2025-07-18T14:21:44.885Z

Source :

GitHub_M
AFFECTED PRODUCTS

The following products are affected by CVE-2025-53908 vulnerability.

No data.

REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2025-53908.

URL Resource
https://github.com/rommapp/romm/blob/4.0.0-beta.2/backend/endpoints/raw.py#L31 cve-icon cve-icon
https://github.com/rommapp/romm/commit/7c94cb05e74ddb6a6af7b82320686c01754e9966 cve-icon cve-icon
https://github.com/rommapp/romm/commit/baa1a9759079c36e36a9f10c920c46b57d0b6151 cve-icon cve-icon
https://github.com/rommapp/romm/security/advisories/GHSA-fx9g-xw4j-jwc3 cve-icon cve-icon cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Attack Requirements
Privileges Required
User Interaction
VS Confidentiality
VS Integrity
VS Availability
SS Confidentiality
SS Integrity
SS Availability