Rommapp Romm vulnerabilities

CVE-2025-65027 [HIGH] CWE-79 CVE-2025-65027: RomM (ROM Manager) allows users to scan, enrich, browse and play their game collections with a clean RomM (ROM Manager) allows users to scan, enrich, browse and play their game collections with a clean and responsive interface. RomM contains multiple unrestricted file upload vulnerabilities that allow authenticated users to upload malicious SVG or HTML files. When these files are accessed the browser executes embedded JavaScript, leading to stored Cro

CVE-2025-54071 [CRITICAL] CWE-434 CVE-2025-54071: RomM (ROM Manager) allows users to scan, enrich, browse and play their game collections with a clean RomM (ROM Manager) allows users to scan, enrich, browse and play their game collections with a clean and responsive interface. In versions 4.0.0-beta.3 and below, an authenticated arbitrary file write vulnerability exists in the /api/saves endpoint. This can lead to Remote Code Execution on the system. The vulnerability permits arbitrary file writ

CVE-2025-53908 [HIGH] CWE-26 CVE-2025-53908: RomM is a self-hosted rom manager and player. Versions prior to 3.10.3 and 4.0.0-beta.3 have an auth RomM is a self-hosted rom manager and player. Versions prior to 3.10.3 and 4.0.0-beta.3 have an authenticated path traversal vulnerability in the `/api/raw` endpoint. Anyone running the latest version of RomM and has multiple users, even unprivileged users, such as the kiosk user in the official implementation, may be affected. This allows the leakage

CVE-2025-65097 [MEDIUM] CWE-284 CVE-2025-65097: RomM (ROM Manager) allows users to scan, enrich, browse and play their game collections with a clean RomM (ROM Manager) allows users to scan, enrich, browse and play their game collections with a clean and responsive interface. Prior to 4.4.1 and 4.4.1-beta.2, an Authenticated User can delete collections belonging to other users by directly sending a DELETE request to the collection endpoint. No ownership verification is performed before deleting c

CVE-2025-65096 [MEDIUM] CWE-284 CVE-2025-65096: RomM (ROM Manager) allows users to scan, enrich, browse and play their game collections with a clean RomM (ROM Manager) allows users to scan, enrich, browse and play their game collections with a clean and responsive interface. Prior to 4.4.1 and 4.4.1-beta.2, users can read private collections / smart collections belonging to other users by directly accessing their IDs via API. No ownership verification or checking if the collection is public/priv