What is GHSA-cgrg-86m5-xm4w?

GHSA-cgrg-86m5-xm4w is a security advisory published by GitHub Security Advisories with Medium severity. Memos Vulnerable to Stored Cross-Site Scripting

Which CVE IDs does GHSA-cgrg-86m5-xm4w cover?

GHSA-cgrg-86m5-xm4w covers the following CVE IDs: CVE-2025-56761. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-cgrg-86m5-xm4w?

GHSA-cgrg-86m5-xm4w has a CVSS v3 base score of 5.4, published by GitHub Security Advisories.

Which products are affected by GHSA-cgrg-86m5-xm4w?

GHSA-cgrg-86m5-xm4w affects 1 product, including: go/github.com/usememos/memos:\u003c= 0.22.0.

GHSA-cgrg-86m5-xm4wMediumCVSS 5.4

Memos Vulnerable to Stored Cross-Site Scripting

Vendor

GitHub Security Advisories

Published

September 4, 2025

Last Modified

September 5, 2025

🔗 CVE IDs covered (1)

CVE-2025-56761 →

📋 Description

Memos 0.22 is vulnerable to Stored Cross site scripting (XSS) vulnerabilities by the upload attachment and user avatar features. Memos does not verify the content type of the uploaded data and serve it back as is. An authenticated attacker can use this to elevate their privileges when the stored XSS is viewed by an admin.

🎯 Affected products1

go/github.com/usememos/memos:<= 0.22.0

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2025-56761
https://github.com/usememos/memos/blob/v0.24.0/server/router/api/v1/user_service.go#L147
https://github.com/usememos/memos/blob/v0.24.4/server/router/api/v1/resource_service.go#L48
https://www.sonarsource.com/blog/securing-go-applications-with-sonarqube-real-world-examples
https://github.com/advisories/GHSA-cgrg-86m5-xm4w