CVE-2025-65027
BaseFortify
Publication date: 2025-12-03
Last updated on: 2026-02-24
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| romm.app | romm | to 4.4.1 (exc) |
| romm.app | romm | 4.4.1 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-434 | The product allows the upload or transfer of dangerous file types that are automatically processed within its environment. |
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
| CWE-352 | The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
RomM (ROM Manager) has multiple unrestricted file upload vulnerabilities that allow authenticated users to upload malicious SVG or HTML files. When these files are accessed, the browser executes embedded JavaScript, causing stored Cross-Site Scripting (XSS). Combined with a CSRF misconfiguration, this can lead to full administrative account takeover, including creating rogue admin accounts and escalating attacker privileges.
How can this vulnerability impact me? :
This vulnerability can lead to an attacker gaining full administrative control over the RomM application. They can create rogue admin accounts, escalate their privileges, and potentially perform unauthorized actions, compromising the integrity and security of the system and its data.
What immediate steps should I take to mitigate this vulnerability?
The immediate step to mitigate this vulnerability is to upgrade RomM (ROM Manager) to version 4.4.1 or 4.4.1-beta.2, where the unrestricted file upload vulnerabilities have been fixed.