CVE-2025-54071: RomM (ROM Manager) RCE Vulnerability

CVE-2025-54071 Overview

CVE-2025-54071 is a critical arbitrary file write vulnerability affecting RomM (ROM Manager), an application that allows users to scan, enrich, browse, and play their game collections with a clean and responsive interface. In versions 4.0.0-beta.3 and below, an authenticated arbitrary file write vulnerability exists in the /api/saves endpoint. This vulnerability can be exploited to achieve Remote Code Execution (RCE) on the target system.

The vulnerability permits arbitrary file write operations, allowing attackers to create or modify files at any filesystem location with user-supplied content. A user with viewer role or Scope.ASSETS_WRITE permission or above is required to pass authentication checks.

Critical Impact

Authenticated attackers can write arbitrary files to any filesystem location, potentially leading to Remote Code Execution, system compromise, and complete takeover of the RomM server.

Affected Products

• RomM (ROM Manager) versions 4.0.0-beta.3 and below

Discovery Timeline

• 2025-07-21 - CVE-2025-54071 published to NVD
• 2025-07-22 - Last updated in NVD database

Technical Details for CVE-2025-54071

Vulnerability Analysis

This vulnerability is classified under CWE-434 (Unrestricted Upload of File with Dangerous Type). The /api/saves endpoint in RomM fails to properly validate or sanitize file paths provided by users, enabling authenticated attackers to write arbitrary content to any location on the filesystem accessible by the application process.

The attack requires authentication with at least viewer role or Scope.ASSETS_WRITE permission. While this limits exploitation to authenticated users, many deployments may have relaxed access controls or shared credentials, making this a significant threat in multi-user environments.

Root Cause

The root cause is improper input validation in the file save functionality. The application does not adequately sanitize user-supplied file paths before performing write operations, allowing path traversal sequences or absolute paths to be used. This enables attackers to escape the intended directory structure and write files to arbitrary locations on the server's filesystem.

Attack Vector

The attack is network-based and requires authentication with minimal privileges. An attacker with viewer role or Scope.ASSETS_WRITE permission can send a crafted request to the /api/saves endpoint containing a malicious file path. By manipulating the path parameter, the attacker can direct file writes outside the intended save directory.

Successful exploitation can lead to:

• Writing malicious scripts to web-accessible directories
• Overwriting configuration files to inject malicious settings
• Placing executable files in locations that trigger automatic execution
• Achieving Remote Code Execution by writing to cron directories, SSH authorized_keys, or other sensitive locations

The vulnerability mechanism involves the /api/saves endpoint accepting user-controlled file paths without proper validation. Attackers can leverage path traversal techniques (e.g., ../) or absolute paths to write files to arbitrary filesystem locations. For detailed technical analysis, refer to the GitHub Security Advisory.

Detection Methods for CVE-2025-54071

Indicators of Compromise

• Unusual file creation or modification in system directories outside the RomM data directory
• Unexpected files appearing in web-accessible directories, cron directories, or SSH configuration paths
• API requests to /api/saves containing path traversal sequences (../) or absolute paths
• New or modified files with suspicious content in /etc/cron.d/, ~/.ssh/, or similar sensitive locations

Detection Strategies

• Monitor HTTP requests to the /api/saves endpoint for path traversal patterns and absolute path references
• Implement file integrity monitoring (FIM) on sensitive system directories to detect unauthorized file modifications
• Review web server and application logs for suspicious API activity from authenticated users
• Deploy web application firewall (WAF) rules to detect and block path traversal attempts

Monitoring Recommendations

• Enable detailed logging for all file write operations in RomM
• Configure alerts for file creation events outside the expected RomM data directories
• Monitor user account activity for unusual patterns or privilege abuse
• Implement network traffic analysis to identify anomalous API request patterns

How to Mitigate CVE-2025-54071

Immediate Actions Required

• Upgrade RomM immediately to version 4.0.0-beta.4 or later, which contains the security fix
• Review user accounts and permissions, removing unnecessary Scope.ASSETS_WRITE permissions
• Audit recent file system changes for signs of exploitation
• Implement network segmentation to limit exposure of the RomM application

Patch Information

The vulnerability has been fixed in RomM version 4.0.0-beta.4. The fix is available in commit 89248d03805e5fabca78443dd202ff32e0b4d9f3. Users should upgrade to the patched version immediately. For additional details, see the GitHub commit and the GitHub Security Advisory GHSA-fgxf-hggc-qqmq.

Workarounds

• Restrict network access to the RomM application using firewall rules until patching is complete
• Review and minimize user permissions, ensuring only trusted users have viewer role or Scope.ASSETS_WRITE access
• Implement additional access controls at the reverse proxy level to restrict access to the /api/saves endpoint
• Run the RomM application with minimal filesystem permissions to limit the impact of arbitrary file write operations

# Example: Restrict filesystem access using Docker volume restrictions
# Mount only necessary directories as read-write, others as read-only
docker run -d \
  --name romm \
  -v /path/to/library:/romm/library:rw \
  -v /path/to/resources:/romm/resources:ro \
  -v /path/to/config:/romm/config:ro \
  --read-only \
  --tmpfs /tmp \
  romm/romm:4.0.0-beta.4