CVE-2025-56761

Vulnerability

Overview

Memos 0.22 is vulnerable to stored cross-site scripting (XSS) through its attachment upload and user avatar features. The application fails to verify the content type of uploaded data and serves the file back to users as-is, allowing an attacker to upload arbitrary HTML or JavaScript content [1][2].

Exploitation

Prerequisites

An attacker must be authenticated to the Memos instance. The upload endpoint does not perform any content-type validation, so a malicious file (e.g., an HTML file containing JavaScript) can be uploaded as an attachment or avatar. When an administrator views the uploaded content—for example, by opening the attachment or loading the attacker's avatar—the injected script executes in the admin's browser session [1][2].

Impact

Successful exploitation enables the attacker to perform actions with the privileges of the viewing admin. This can lead to full platform compromise, including data exfiltration, account manipulation, or further server-side attacks if the admin session is leveraged [1].

Mitigation

Status

Memos maintainers did not respond to responsible disclosure; Sonar published the findings under its 90-day disclosure policy [1]. As of the latest available code (v0.24.4), the vulnerability remains unpatched. Organizations are advised to restrict access to Memos to trusted users only until a fix is released [1].