CVE-2025-54071 RomM's authenticated arbitrary file write vulnerability can lead to Remote Code Execution

RomM ROM Manager allows users to scan, enrich, browse and play their game collections with a clean and responsive interface. In versions 4.0.0-beta.3 and below, an authenticated arbitrary file write vulnerability exists in the /api/saves endpoint. This can lead to Remote Code Execution on the...

CVE-2025-54071 RomM's authenticated arbitrary file write vulnerability can lead to Remote Code Execution

RomM ROM Manager allows users to scan, enrich, browse and play their game collections with a clean and responsive interface. In versions 4.0.0-beta.3 and below, an authenticated arbitrary file write vulnerability exists in the /api/saves endpoint. This can lead to Remote Code Execution on the...

CVE-2025-54071 RomM's authenticated arbitrary file write vulnerability can lead to Remote Code Execution

RomM ROM Manager allows users to scan, enrich, browse and play their game collections with a clean and responsive interface. In versions 4.0.0-beta.3 and below, an authenticated arbitrary file write vulnerability exists in the /api/saves endpoint. This can lead to Remote Code Execution on the...

PT-2025-30340 · Romm · Romm

Name of the Vulnerable Software and Affected Versions: RomM versions 4.0.0-beta.3 and below Description: RomM is a tool that allows users to manage their game collections. An authenticated arbitrary file write issue exists in the /api/saves endpoint. This can lead to Remote Code Execution. The...

Romm 代码问题漏洞

Romm is an open source manager for read-only memory from The RomM Project. A code issue vulnerability exists in Romm 4.0.0-beta.3 and prior versions that stems from improper access control of the /api/saves endpoint, which could lead to arbitrary file writes and remote code execution...

CVE-2025-53908

RomM is a self-hosted rom manager and player. Versions prior to 3.10.3 and 4.0.0-beta.3 have an authenticated path traversal vulnerability in the /api/raw endpoint. Anyone running the latest version of RomM and has multiple users, even unprivileged users, such as the kiosk user in the official...

CVE-2025-53908

RomM is a self-hosted rom manager and player. Versions prior to 3.10.3 and 4.0.0-beta.3 have an authenticated path traversal vulnerability in the /api/raw endpoint. Anyone running the latest version of RomM and has multiple users, even unprivileged users, such as the kiosk user in the official...

CVE-2025-53908

RomM is affected by an authenticated path traversal vulnerability in the /api/raw endpoint. Versions prior to 3.10.3 and prior to 4.0.0-beta.3 are vulnerable. The issue can allow leakage of passwords and user data on systems with multiple users (including unprivileged users such as the kiosk user...

CVE-2025-53908 RomM vulnerable to Authenticated Path Traversal

RomM is a self-hosted rom manager and player. Versions prior to 3.10.3 and 4.0.0-beta.3 have an authenticated path traversal vulnerability in the /api/raw endpoint. Anyone running the latest version of RomM and has multiple users, even unprivileged users, such as the kiosk user in the official...

CVE-2025-53908 RomM vulnerable to Authenticated Path Traversal

RomM is a self-hosted rom manager and player. Versions prior to 3.10.3 and 4.0.0-beta.3 have an authenticated path traversal vulnerability in the /api/raw endpoint. Anyone running the latest version of RomM and has multiple users, even unprivileged users, such as the kiosk user in the official...

Romm 安全漏洞

Romm is an open source read-only memory manager from The RomM Project. A security vulnerability exists in RomM versions prior to 3.10.3 and prior to 4.0.0-beta.3, which stems from the presence of authentication path traversal in the api/raw endpoints, which could lead to the disclosure of passwor...

PT-2025-29876 · Romm · Romm

Name of the Vulnerable Software and Affected Versions: RomM versions prior to 3.10.3 RomM versions prior to 4.0.0-beta.3 Description: RomM, a self-hosted rom manager and player, contains an authenticated path traversal issue in the /api/raw endpoint. This allows for the leakage of passwords and...