CVE-2025-56761 | Teknoloji dünyasından en güncel haberleri ve güvenlikle ilgili gelişmeleri takip edin.

Memos 0.22 is vulnerable to Stored Cross site scripting (XSS) vulnerabilities by the upload attachment and user avatar features. Memos does not verify the conte…
Medium CVSS: 5.4

CVE-2025-56761

Memos 0.22 is vulnerable to Stored Cross site scripting (XSS) vulnerabilities by the upload attachment and user avatar features. Memos does not verify the content type of the uploaded data and serve it back as is. An authenticated attacker can use this to elevate their privileges when the stored XSS is viewed by an admin.
Vendor
Usememos
Product
Memos
CWE
CWE-79
Yayın Tarihi
2025-09-03 17:15:34
Güncelleme
2025-09-09 18:27:28
Source Identifier
cve@mitre.org
KEV Date Added
-

Kategoriler

CWE-79 Memos MEDIUM Usememos 2025

Referanslar

https://github.com/usememos/memos/blob/v0.24.0/server/router/api/v1/user_service.go#L147 https://github.com/usememos/memos/blob/v0.24.4/server/router/api/v1/resource_service.go#L48 https://www.sonarsource.com/blog/securing-go-applications-with-sonarqube-real-world-examples/