Overview
A high-severity security vulnerability, identified as CVE-2025-65027, has been discovered in RomM (ROM Manager). RomM is a software application designed to scan, enrich, browse, and play game collections through a clean and responsive interface. This vulnerability stems from unrestricted file upload capabilities, allowing authenticated users to upload malicious SVG or HTML files. When these files are accessed, the browser executes embedded JavaScript, resulting in stored Cross-Site Scripting (XSS). This XSS, combined with a Cross-Site Request Forgery (CSRF) misconfiguration, can be exploited to achieve full administrative account takeover, leading to the creation of rogue admin accounts, escalation of attacker privileges, and other critical impacts.
Technical Details
The vulnerability exists because RomM does not properly sanitize uploaded files. Specifically, authenticated users can upload malicious SVG or HTML files. These files contain embedded JavaScript code that gets executed by the browser when other users access the uploaded file. This leads to Stored or Persistent XSS. The CSRF vulnerability allows attackers to perform actions on behalf of an authenticated user without their knowledge or consent. By chaining the stored XSS with the CSRF vulnerability, an attacker can craft a request that, when triggered by an admin user, will create a new admin account, escalate the attacker’s privileges, or perform other administrative actions.
CVSS Analysis
The Common Vulnerability Scoring System (CVSS) score for CVE-2025-65027 is 7.6, indicating a HIGH severity. This score reflects the significant potential impact of the vulnerability, including administrative access compromise.
The base score is derived from several factors including attack vector (network), attack complexity (low), privileges required (low), user interaction (required), scope (changed), confidentiality impact (high), integrity impact (high), and availability impact (high).
Possible Impact
Successful exploitation of CVE-2025-65027 can have severe consequences:
- Full Administrative Account Takeover: Attackers can gain complete control over the RomM instance.
- Rogue Admin Account Creation: Attackers can create new administrator accounts.
- Privilege Escalation: Attackers can escalate their own account privileges to administrator level.
- Data Breach: Sensitive data stored within the RomM instance could be compromised.
- Malicious Code Injection: Injecting malicious JavaScript code can be used to compromise other users’ accounts or systems.
- Defacement: Attackers can modify the interface of RomM.
Mitigation or Patch Steps
To mitigate the risk posed by CVE-2025-65027, users of RomM are strongly advised to upgrade to version 4.4.1 or 4.4.1-beta.2. These versions contain the necessary fixes to address the unrestricted file upload vulnerabilities and prevent exploitation. Applying the patch is the recommended solution to remove the vulnerability. As a temporary measure, consider restricting file upload access to only trusted users until the patch can be applied.
