Stored Cross Site Scripting Vulnerability in Memos from UseMemos
CVE-2025-56761

5.4MEDIUM

Key Information:

Vendor

UseMemos

Status
Memos
Vendor
CVE Published:
3 September 2025

What is CVE-2025-56761?

Memos, an application from UseMemos, is susceptible to Stored Cross Site Scripting (XSS) vulnerabilities in its upload attachment and user avatar features. The software fails to adequately verify the content type of uploaded data, allowing attackers to inject malicious scripts. When an administrator views the stored XSS, an authenticated attacker can leverage this flaw to escalate their privileges, which may jeopardize the application's security. This exposes potential risks for both the application's integrity and its users.

References

https://github.com/usememos/memos/blob/v0.24.4/server/rou...
https://github.com/usememos/memos/blob/v0.24.0/server/rou...
https://www.sonarsource.com/blog/securing-go-applications...

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.