CVE-2025-56761: Memos 0.22 is vulnerable to Stored Cross site scripting (XSS) vulnerabilities by the upload attachment and user avatar features. Memos does not verify the…

PriorityP428medium5.4CVSS 3.1

AVNACLPRLUIRSCCLILAN

EPSS

0.24%

14.5th percentile

Memos 0.22 is vulnerable to Stored Cross site scripting (XSS) vulnerabilities by the upload attachment and user avatar features. Memos does not verify the content type of the uploaded data and serve it back as is. An authenticated attacker can use this to elevate their privileges when the stored XSS is viewed by an admin.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
github.com	usememos_memos	0 – 0.22.0	—
usememos	memos	—	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.