CVE-2025-65027
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-12-03

Last updated on: 2026-02-24

Assigner: GitHub, Inc.

Description
RomM (ROM Manager) allows users to scan, enrich, browse and play their game collections with a clean and responsive interface. RomM contains multiple unrestricted file upload vulnerabilities that allow authenticated users to upload malicious SVG or HTML files. When these files are accessed the browser executes embedded JavaScript, leading to stored Cross-Site Scripting (XSS) which when combined with a CSRF misconfiguration they lead to achieve full administrative account takeover, creating a rogue admin account, escalating the attacker account role to admin, and much more. This vulnerability is fixed in 4.4.1 and 4.4.1-beta.2.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-12-03
Last Modified
2026-02-24
Generated
2026-06-16
AI Q&A
2025-12-03
EPSS Evaluated
2026-06-15
NVD
CVE-2025-65027
EUVD
EUVD-2025-201131
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
romm.app romm to 4.4.1 (exc)
romm.app romm 4.4.1
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
CWE-434 The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

RomM (ROM Manager) has multiple unrestricted file upload vulnerabilities that allow authenticated users to upload malicious SVG or HTML files. When these files are accessed, the browser executes embedded JavaScript, causing stored Cross-Site Scripting (XSS). Combined with a CSRF misconfiguration, this can lead to full administrative account takeover, including creating rogue admin accounts and escalating attacker privileges.

Impact Analysis

This vulnerability can lead to an attacker gaining full administrative control over the RomM application. They can create rogue admin accounts, escalate their privileges, and potentially perform unauthorized actions, compromising the integrity and security of the system and its data.

Mitigation Strategies

The immediate step to mitigate this vulnerability is to upgrade RomM (ROM Manager) to version 4.4.1 or 4.4.1-beta.2, where the unrestricted file upload vulnerabilities have been fixed.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-65027. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart