~ / search / GHSA-78j5-8vq7-jxv5

GHSA-78j5-8vq7-jxv5

Memos Vulnerable to Path Traversal via the CreateResource Endpoint

Source: GitHub Advisory Database (reviewed) Moderate CVE-2025-56760

Packages

EcosystemPackageAffectedFixed in
Go github.com/usememos/memos <= 0.22.0 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

When Memos 0.22 is configured to store objects locally, an attacker can create a file via the CreateResource endpoint containing a path traversal sequence in the name, allowing arbitrary file write on the server.

References

External links from the advisory. They lead to third-party sites.