What is GHSA-qgjp-5g5x-vhq2?

GHSA-qgjp-5g5x-vhq2 is a security advisory published by GitHub Security Advisories with Medium severity. memos lacks file name validation or verification

Which CVE IDs does GHSA-qgjp-5g5x-vhq2 cover?

GHSA-qgjp-5g5x-vhq2 covers the following CVE IDs: CVE-2025-65799. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-qgjp-5g5x-vhq2?

GHSA-qgjp-5g5x-vhq2 has a CVSS v3 base score of 4.3, published by GitHub Security Advisories.

Which products are affected by GHSA-qgjp-5g5x-vhq2?

GHSA-qgjp-5g5x-vhq2 affects 1 product, including: go/github.com/usememos/memos:\u003c 0.25.3.

GHSA-qgjp-5g5x-vhq2MediumCVSS 4.3

memos lacks file name validation or verification

Vendor

GitHub Security Advisories

Published

December 8, 2025

Last Modified

December 17, 2025

🔗 CVE IDs covered (1)

CVE-2025-65799 →

📋 Description

A lack of file name validation or verification in the Attachment service of usememos memos v0.25.2 allows attackers to execute a path traversal.

🎯 Affected products1

go/github.com/usememos/memos:< 0.25.3

🔗 References (7)

https://nvd.nist.gov/vuln/detail/CVE-2025-65799
https://github.com/usememos/memos/pull/5218
https://herolab.usd.de/security-advisories/usd-2025-0056
http://memos.com
http://usememos.com
https://github.com/usememos/memos/commit/5f57f48673e2054f404b2c5b497a8eaa3690591d
https://github.com/advisories/GHSA-qgjp-5g5x-vhq2