VulnerabilityAnalyzed
CVE-2025-56761
Memos 0.22 is vulnerable to Stored Cross site scripting (XSS) vulnerabilities by the upload attachment and user avatar features.
MEDIUM 5.4EPSS 0.25%
Does this matter?
Lower severity and a low EPSS score (0.25%). Track it; it rarely justifies an emergency change on its own.
Description
Memos 0.22 is vulnerable to Stored Cross site scripting (XSS) vulnerabilities by the upload attachment and user avatar features. Memos does not verify the content type of the uploaded data and serve it back as is. An authenticated attacker can use this to elevate their privileges when the stored XSS is viewed by an admin.
- CVSS 3.1
- 5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- EPSS
- 0.25% probability · 17th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- usememos/memos
- Source
- cve@mitre.org
References
- https://github.com/usememos/memos/blob/v0.24.0/server/router/api/v1/user_service.go#L147Product
- https://github.com/usememos/memos/blob/v0.24.4/server/router/api/v1/resource_service.go#L48Product
- https://www.sonarsource.com/blog/securing-go-applications-with-sonarqube-real-world-examples/Exploit, Patch, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.