CVE-2025-53908 - CVE House
Back to Database
Status published High CVE-2025-53908

RomM vulnerable to Authenticated Path Traversal

Vulnerability Description

RomM is a self-hosted rom manager and player. Versions prior to 3.10.3 and 4.0.0-beta.3 have an authenticated path traversal vulnerability in the `/api/raw` endpoint. Anyone running the latest version of RomM and has multiple users, even unprivileged users, such as the kiosk user in the official implementation, may be affected. This allows the leakage of passwords and users that may be stored on the system. Versions 3.10.3 and 4.0.0-beta.3 contain a patch.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-53908

Credits & Attribution

No credits recorded in the NVD database.

References

More from rommapp

View All →
CVE-2025-65097
Insecure Direct Object Reference (IDOR) Allows Unauthorized Deletion of User Collections
High 7.1
CVE-2025-65096
RomM Insecure Direct Object Reference (IDOR) Allows Unauthorized Access to Private Collections
Medium 5.3
CVE-2025-65027
RomM Chained XSS and CSRF Vulnerabilities Enable Admin Account Takeover
High 7.6
CVE-2025-54071
RomM's authenticated arbitrary file write vulnerability can lead to Remote Code Execution
Critical 9.4

Affected Vendor

Affected Software

romm
Vulnerable Versions:
< 3.10.3, < 4.0.0-beta.3

Timeline

Official Publish: July 16th, 2025
Last Modified: July 18th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-26

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.