CVE-2025-56761 Memos Vulnerable to Stored Cross-Site Scripting

Medium 5.4 Published 3 Sep 2025 Updated 4 Sep 2025

An authenticated attacker can inject malicious scripts via file uploads to escalate privileges when viewed by an administrator.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2025-56761?

CVE-2025-56761 is a medium-severity cross-site scripting vulnerability in Usememos Memos, published on 3 Sep 2025. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

Memos 0.22 is vulnerable to Stored Cross site scripting (XSS) vulnerabilities by the upload attachment and user avatar features. Memos does not verify the content type of the uploaded data and serve it back as is. An authenticated attacker can use this to elevate their privileges when the stored XSS is viewed by an admin.

Weakness: CWE-79

Which versions are affected by CVE-2025-56761?

3 open source packages ship an affected version, including github.com/usememos/memos. It affects 1 product.

Package	Affected	Fixed in
`github.com/usememos/memos` Go	All versions	None
`github.com/usememos/memos` Go	All versions to `0.22.0`	None
`github.com/usememos/memos` Go	All versions to `0.22.0`	None

Products include Usememos Memos.

How do I fix CVE-2025-56761?

Upgrade to a fixed version.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2025-56761 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-56761 exists.

All Usememos Memos vulnerabilities

Sources

Also known as GHSA-cgrg-86m5-xm4w, GO-2025-3937.