rommapp romm up to 4.4.0/4.4.1-beta.1 File Upload cross site scripting

Summaryinfo

A vulnerability, which was classified as problematic, has been found in rommapp romm up to 4.4.0/4.4.1-beta.1. This affects an unknown part of the component File Upload. This manipulation causes cross site scripting. This vulnerability is tracked as CVE-2025-65027. The attack is possible to be carried out remotely. Moreover, an exploit is present. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability has been found in rommapp romm up to 4.4.0/4.4.1-beta.1 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component File Upload. The manipulation with an unknown input leads to a cross site scripting vulnerability. The CWE definition for the vulnerability is CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. As an impact it is known to affect integrity. The summary by CVE is:

RomM (ROM Manager) allows users to scan, enrich, browse and play their game collections with a clean and responsive interface. RomM contains multiple unrestricted file upload vulnerabilities that allow authenticated users to upload malicious SVG or HTML files. When these files are accessed the browser executes embedded JavaScript, leading to stored Cross-Site Scripting (XSS) which when combined with a CSRF misconfiguration they lead to achieve full administrative account takeover, creating a rogue admin account, escalating the attacker account role to admin, and much more. This vulnerability is fixed in 4.4.1 and 4.4.1-beta.2.

The advisory is shared at github.com. This vulnerability is known as CVE-2025-65027 since 11/13/2025. The exploitation appears to be easy. The attack can be launched remotely. It demands that the victim is doing some kind of user interaction. Technical details are unknown but a public exploit is available. MITRE ATT&CK project uses the attack technique T1059.007 for this issue.

It is possible to download the exploit at exploit-db.com. It is declared as proof-of-concept.

Upgrading to version 4.4.1 or 4.4.1-beta.2 eliminates this vulnerability.

The vulnerability is also documented in the databases at Exploit-DB (52505) and EUVD (EUVD-2025-201131). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• rommapp

Name

• romm

Version

• 4.0
• 4.1
• 4.2
• 4.3
• 4.4.0
• 4.4.1-beta.0
• 4.4.1-beta.1

Website

• Product: https://github.com/rommapp/romm/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion