CVE-2025-53908CWE-26

RomM vulnerable to Authenticated Path Traversal

High · published July 16, 2025

CVSS v4.0
8.3
EPSS
1%
Percentile
44.6
In the wild
Unconfirmed
What it is

RomM is a self-hosted rom manager and player. Versions prior to 3.10.3 and 4.0.0-beta.3 have an authenticated path traversal vulnerability in the `/api/raw` endpoint. Anyone running the latest version of RomM and has multiple users, even unprivileged users, such as the kiosk user in the official implementation, may be affected. This allows the leakage of passwords and users that may be stored on the system. Versions 3.10.3 and 4.0.0-beta.3 contain a patch.

The record
Technical detail
CVSS v4.0
8.3 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
EPSS
0.00540 · 44.6th percentile
Weakness
CWE-26 · Path Traversal: '/dir/../filename'
Published
2025-07-16T19:55Z
EPSS history
Timeline
  • 16 JUL 19:55Z
    RomM vulnerable to Authenticated Path Traversal
    cvelistv5