CVE-2025-54071
Published: 21 July 2025
Summary
CVE-2025-54071 is a critical-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability. Its CVSS base score is 9.4 (Critical).
Operationally, ranked in the top 13.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
RomM, also known as ROM Manager, is an open-source tool for scanning, enriching, browsing, and playing game collections. Versions 4.0.0-beta.3 and earlier contain an authenticated arbitrary file write flaw in the /api/saves endpoint that permits an attacker to create or overwrite files at arbitrary filesystem paths with attacker-supplied content, directly enabling remote code execution. The issue is tracked as CWE-434 and carries a CVSS 4.0 score of 9.4.
An attacker who has already obtained a viewer role or the Scope.ASSETS_WRITE permission can send crafted requests to the affected endpoint and place executable payloads or configuration files anywhere on the host filesystem, achieving full system compromise without further user interaction.
The vulnerability is resolved in version 4.0.0-beta.4; the project’s security advisory and the associated commit on GitHub document the fix and recommend that administrators upgrade immediately. The EPSS score remains flat at 0.0307 with no observed increase after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-22157
Vulnerability details
RomM (ROM Manager) allows users to scan, enrich, browse and play their game collections with a clean and responsive interface. In versions 4.0.0-beta.3 and below, an authenticated arbitrary file write vulnerability exists in the /api/saves endpoint. This can lead to…
more
Remote Code Execution on the system. The vulnerability permits arbitrary file write operations, allowing attackers to create or modify files at any filesystem location with user-supplied content. A user with viewer role or Scope.ASSETS_WRITE permission or above is required to pass authentication checks. The vulnerability is fixed in version 4.0.0-beta.4.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Requiring identifiable owners for portable devices reduces the attack surface for unrestricted uploads of dangerous file types via anonymous media.
Dangerous file uploads can be detonated in the chamber to determine malice before any production write or execution occurs.
Prevents unrestricted writing of arbitrary or malicious firmware by keeping hardware write-protect enabled except under tightly controlled manual procedures.
Scans files from external sources on download/open/execute, blocking unrestricted uploads of dangerous file types.