CVE-2024-29030 memos vulnerable to an SSRF in /api/resource

What is CVE-2024-29030?

CVE-2024-29030 is a medium-severity server-side request forgery vulnerability in Usememos Memos, published on 19 Apr 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

memos is a privacy-first, lightweight note-taking service. In memos 0.13.2, an SSRF vulnerability exists at the /api/resource that allows authenticated users to enumerate the internal network. Version 0.22.0 of memos removes the vulnerable file.

Weakness: CWE-918

Which versions are affected by CVE-2024-29030?

3 open source packages ship an affected version, including github.com/usememos/memos. It affects 1 product.

Products include Usememos Memos.

How do I fix CVE-2024-29030?

Upgrade github.com/usememos/memos to 0.22.0 or later.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2024-29030 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-29030 exists.

Public exploit code: 1 Nuclei template.

Other vulnerabilities in Usememos Memos

• CVE-2025-50738 Memos has Cross-Site Scripting (XSS) Vulnerability in Image URLs Critical 9.8
• CVE-2025-22952 Memos Server-Side Request Forgery (SSRF) Critical 9.8
• CVE-2023-0109 Stored XSS in usememos/memos Critical 9.8
• CVE-2023-4696 Improper Access Control in usememos/memos Critical 9.8
• CVE-2022-4866 Cross-site Scripting (XSS) - Stored in usememos/memos Critical 9.8

All Usememos Memos vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-65fm-2jgr-j7qq, GO-2024-3046.