CVE-2025-56760: Path Traversal
When Memos 0.22 is configured to store objects locally, an attacker can create a file via the CreateResource endpoint containing a path traversal sequence in the name, allowing arbitrary file write on the server.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-56760?
CVE-2025-56760 is considered a medium severity vulnerability due to its potential for arbitrary file write on the server.
How do I fix CVE-2025-56760?
To fix CVE-2025-56760, ensure that path traversal sequences are properly sanitized and validated in the CreateResource endpoint.
What software versions are affected by CVE-2025-56760?
CVE-2025-56760 affects Memos versions up to and including 0.22.0.
What impact does CVE-2025-56760 have on Memos users?
CVE-2025-56760 allows an attacker to write arbitrary files to the server, which could lead to data leakage or system compromise.
Is there a known exploit for CVE-2025-56760?
While there is no publicly disclosed exploit for CVE-2025-56760 as of now, the vulnerability's nature poses significant risk if left unaddressed.