Security Advisory

CVE-2025-53908

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2025-07-16 19:55:15

Last updated 2025-07-18 14:21:44

Assigner GitHub_M

CVSS score not scored

State PUBLISHED

Description

RomM is a self-hosted rom manager and player. Versions prior to 3.10.3 and 4.0.0-beta.3 have an authenticated path traversal vulnerability in the `/api/raw` endpoint. Anyone running the latest version of RomM and has multiple users, even unprivileged users, such as the kiosk user in the official implementation, may be affected. This allows the leakage of passwords and users that may be stored on the system. Versions 3.10.3 and 4.0.0-beta.3 contain a patch.

← Browse all CVEs View on cve.org ↗