CVE-2025-53908 RomM vulnerable to Authenticated Path Traversal
Authenticated users can exploit a path traversal flaw in RomM to leak stored passwords and user data.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-53908?
CVE-2025-53908 is a high-severity path traversal vulnerability in rommapp romm, published on 16 Jul 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
RomM is a self-hosted rom manager and player. Versions prior to 3.10.3 and 4.0.0-beta.3 have an authenticated path traversal vulnerability in the `/api/raw` endpoint. Anyone running the latest version of RomM and has multiple users, even unprivileged users, such as the kiosk user in the official implementation, may be affected. This allows the leakage of passwords and users that may be stored on the system. Versions 3.10.3 and 4.0.0-beta.3 contain a patch.
Weakness: CWE-26
Which versions are affected by CVE-2025-53908?
How do I fix CVE-2025-53908?
No fix has been published for CVE-2025-53908 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2025-53908 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-53908 exists.
Sources
Also known as GHSA-fx9g-xw4j-jwc3.