CVE-2025-53908

🗓️ 16 Jul 2025 19:55:15Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 90 Views🌐 WEB

RomM prior to 3.10.3 has an authenticated path traversal vulnerability affecting user data leakage.

Reporter	Title	Published	Views	Family All 10
CNNVD	Romm security vulnerabilities	16 Jul 202500:00	–	cnnvd
Cvelist	CVE-2025-53908 RomM vulnerable to Authenticated Path Traversal	16 Jul 202519:55	–	cvelist
EUVD	EUVD-2025-21739	3 Oct 202520:07	–	euvd
Mend	CVE-2025-53908	16 Jul 202519:55	–	mend
NVD	CVE-2025-53908	16 Jul 202520:15	–	nvd
osv_cve	CVE-2025-53908 RomM vulnerable to Authenticated Path Traversal	16 Jul 202519:55	–	osv_cve
Positive Technologies	PT-2025-29876 · Romm · Romm	16 Jul 202500:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2025-53908: Path Traversal: '/dir/../filename'	16 Jul 202500:00	–	rapid7
RedhatCVE	CVE-2025-53908	18 Jul 202520:05	–	redhatcve
Vulnrichment	CVE-2025-53908 RomM vulnerable to Authenticated Path Traversal	16 Jul 202519:55	–	vulnrichment

Vulners

Node

romm.app rommRange<3.10.3

romm.app rommRange<4.0.0-beta.3

[
  {
    "vendor": "rommapp",
    "product": "romm",
    "versions": [
      {
        "version": "< 3.10.3",
        "status": "affected"
      },
      {
        "version": "< 4.0.0-beta.3",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/rommapp/romm/commit/7c94cb05e74ddb6a6af7b82320686c01754e9966
github	www.github.com/rommapp/romm/commit/baa1a9759079c36e36a9f10c920c46b57d0b6151
github	www.github.com/rommapp/romm/blob/4.0.0-beta.2/backend/endpoints/raw.py
github	www.github.com/rommapp/romm/security/advisories/GHSA-fx9g-xw4j-jwc3

Parameter	Position	Path	Description	CWE
path	path	/api/raw	Authenticated path traversal vulnerability in the /api/raw endpoint allowing leakage of system files, including passwords and user data.	CWE-26

17 Jun 2026 09:39Current

5.8Medium risk

Vulners AI Score5.8

CVSS 48.3

EPSS0.0054

SSVC

CWE-26

romm authentic path traversal user data vulnerability patch