CVE-2025-56761

Published: Sep 3, 2025Modified: Jun 17, 2026

5.4

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.3 / Impact: 2.7

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Memos 0.22 is vulnerable to Stored Cross site scripting (XSS) vulnerabilities by the upload attachment and user avatar features. Memos does not verify the content type of the uploaded data and serve it back as is. An authenticated attacker can use this to elevate their privileges when the stored XSS is viewed by an admin.

Affected (1)

Products: Usememos: Memos

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Usememos Memos	Version 0.22.0

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (3)

https://github.com/usememos/memos/blob/v0.24.0/server/router/api/v1/user_service.go#L147

Source: cve@mitre.org

Product

https://github.com/usememos/memos/blob/v0.24.4/server/router/api/v1/resource_service.go#L48

Source: cve@mitre.org

Product

https://www.sonarsource.com/blog/securing-go-applications-with-sonarqube-real-world-examples/

Source: cve@mitre.org

ExploitPatchThird Party Advisory

Timeline

No history available yet.