CVE-2025-65027 - CVE House
Back to Database
Status published High CVE-2025-65027

RomM Chained XSS and CSRF Vulnerabilities Enable Admin Account Takeover

Vulnerability Description

RomM (ROM Manager) allows users to scan, enrich, browse and play their game collections with a clean and responsive interface. RomM contains multiple unrestricted file upload vulnerabilities that allow authenticated users to upload malicious SVG or HTML files. When these files are accessed the browser executes embedded JavaScript, leading to stored Cross-Site Scripting (XSS) which when combined with a CSRF misconfiguration they lead to achieve full administrative account takeover, creating a rogue admin account, escalating the attacker account role to admin, and much more. This vulnerability is fixed in 4.4.1 and 4.4.1-beta.2.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-65027

Credits & Attribution

No credits recorded in the NVD database.

References

More from rommapp

View All →
CVE-2025-65097
Insecure Direct Object Reference (IDOR) Allows Unauthorized Deletion of User Collections
High 7.1
CVE-2025-65096
RomM Insecure Direct Object Reference (IDOR) Allows Unauthorized Access to Private Collections
Medium 5.3
CVE-2025-54071
RomM's authenticated arbitrary file write vulnerability can lead to Remote Code Execution
Critical 9.4
CVE-2025-53908
RomM vulnerable to Authenticated Path Traversal
High 8.3

Affected Vendor

Affected Software

romm
Vulnerable Versions:
< 4.4.1-beta.2

Timeline

Official Publish: December 3rd, 2025
Last Modified: December 3rd, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:H

Weaknesses (CWE)

CWE-79 CWE-352 CWE-434

MITRE ATT&CK TTPs

T1189 Drive-by Compromise
Initial Access
T1059.007 JavaScript
Execution
T1539 Steal Web Session Cookie
Collection
T1213 Data from Information Repositories
Collection
T1567 Exfiltration Over Web Service
Exfiltration
T1491.001 Defacement
Impact
T1566.002 Spearphishing Link
Initial Access
T1204.001 Malicious Link
Execution
T1098 Account Manipulation
Persistence
T1565.001 Stored Data Manipulation
Impact
T1190 Exploit Public-Facing Application
Initial Access
T1505.003 Web Shell
Persistence
T1105 Ingress Tool Transfer
Command and Control
T1059 Command and Scripting Interpreter
Execution
T1565.002 Stored Data Manipulation
Impact