PT-2025-47563 · Romm · Romm

Published 2025-11-20 · Updated 2025-12-03 · CVE-2025-65027

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:H

Name of the Vulnerable Software and Affected Versions RomM versions prior to 4.4.1 RomM version 4.4.1-beta.2

Description RomM allows users to scan, enrich, browse, and play their game collections. The software contains multiple unrestricted file upload flaws that permit authenticated users to upload malicious SVG or HTML files. Accessing these files results in stored Cross-Site Scripting (XSS). Combined with a Cross-Site Request Forgery (CSRF) misconfiguration, this can lead to full administrative account takeover, including the creation of rogue admin accounts and escalation of attacker account roles to administrator level. The vulnerability allows for the execution of embedded JavaScript when the uploaded files are accessed by a browser.

Recommendations Update RomM to version 4.4.1 or 4.4.1-beta.2.

Exploit

Fix

XSS

Unrestricted File Upload

CSRF

Weakness Enumeration

CWE-79

CWE-434

CWE-352

Related Identifiers

CVE-2025-65027

GHSA-V3C6-W996-F7HX

Affected Products

Romm

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/65xxx/CVE-2025-65027.json · Exploit
• 🔥 https://exploit-db.com/exploits/52505 · Exploit
• https://github.com/rommapp/romm/security/advisories/GHSA-v3c6-w996-f7hx · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-65027 · Security Note
• https://osv.dev/vulnerability/CVE-2025-65027 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1996359701680804319 · Twitter Post
• https://twitter.com/CVEnew/status/1996306044100768062 · Twitter Post
• https://biteyourconsole.net/2025/11/20/rilasciato-romm-v4-4-1-patch-per-vulnerabilita-e-miglioramenti-nella-gestione-delle-rom/?fsp_sid=48340 · Reddit Post
• https://t.me/CVEtracker/38790 · Telegram Post