CVE-2025-56761: XSS
Memos 0.22 is vulnerable to Stored Cross site scripting (XSS) vulnerabilities by the upload attachment and user avatar features. Memos does not verify the content type of the uploaded data and serve it back as is. An authenticated attacker can use this to elevate their privileges when the stored XSS is viewed by an admin.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-56761?
CVE-2025-56761 is classified as a high severity vulnerability due to the potential for privilege escalation via stored XSS.
How do I fix CVE-2025-56761?
To fix CVE-2025-56761, ensure that user-uploaded files are properly validated for content type and implement XSS protection measures.
Who is impacted by CVE-2025-56761?
CVE-2025-56761 affects users of Memos version 0.22.0 who utilize the upload attachment and user avatar features.
What type of vulnerability is CVE-2025-56761?
CVE-2025-56761 is a stored Cross Site Scripting (XSS) vulnerability.
Can CVE-2025-56761 lead to data breaches?
Yes, CVE-2025-56761 can lead to data breaches due to privileged access allowing attackers to execute scripts in user sessions.