GitHub Advisoryadvisory · Go

GHSA-78j5-8vq7-jxv5 Memos Vulnerable to Path Traversal via the CreateResource Endpoint

MEDIUM Published 2025-09-04 Modified 2025-09-05 Official page ↗
Aliases
CVE-2025-56760
Ecosystem
Go
Packages
github.com/usememos/memos
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-24
Reviewed
2025-09-05

Affected packages

• Go github.com/usememos/memos: <= 0.22.0 (no fix yet)

Description

When Memos 0.22 is configured to store objects locally, an attacker can create a file via the CreateResource endpoint containing a path traversal sequence in the name, allowing arbitrary file write on the server.

Related

Alias · CVE (1)

  • CVE-2025-56760 When Memos 0.22 is configured to store objects locally, an attacker can create a file via the CreateResource endpoint containing a path… vulnerability

Weakness · CWE (1)

  • CWE-24 Path Traversal: '../filedir' weakness

References