Vulnerability in Rommapp Romm

CVE-2025-53908

RomM is a self-hosted rom manager and player. Versions prior to 3.10.3 and 4.0.0-beta.3 have an authenticated path traversal vulnerability in the `/api/raw` endpoint. Anyone running the latest version of RomM and has multiple users, even u…

EPSS: 0.004 (36.1th percentile) — read the EPSS interpretation.

Affected products

Rommapp Romm — versions < 3.10.3, < 4.0.0-beta.3

Weakness classification (CWE)

CWE-26

References

security-advisories@github.com (x_refsource_CONFIRM)
security-advisories@github.com (x_refsource_MISC)
security-advisories@github.com (x_refsource_MISC)
security-advisories@github.com (x_refsource_MISC)