GitHub Advisoryadvisory · Go

GHSA-wfxg-v3j4-7qmj Memos Server-Side Request Forgery (SSRF)

MEDIUM Published 2025-02-27 Modified 2025-03-03 Official page ↗
Aliases
CVE-2025-22952
Ecosystem
Go
Packages
github.com/usememos/memos
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Weaknesses
CWE-918
Reviewed
2025-02-28

Affected packages

• Go github.com/usememos/memos: <= 0.24.0 (no fix yet)

Description

elestio memos v0.23.0 is vulnerable to Server-Side Request Forgery (SSRF) due to insufficient validation of user-supplied URLs, which can be exploited to perform SSRF attacks.

Related

Alias · CVE (1)

  • CVE-2025-22952 elestio memos v0.23.0 is vulnerable to Server-Side Request Forgery (SSRF) due to insufficient validation of user-supplied URLs, which can… vulnerability

Weakness · CWE (1)

  • CWE-918 Server-Side Request Forgery weakness

References