-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from the lack of filename validation in the resource upload handler. The patch in commit 726285e adds a check for .html extensions in server/resource.go, indicating the vulnerable code was in the anonymous handler function for the POST route (registered in registerResourceRoutes). This handler processed user-uploaded files without sanitizing filenames, enabling XSS via HTML file uploads. The high confidence comes from the direct correlation between the patch location and the CWE-79 XSS weakness description.
GoGo| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/usememos/memos | go | <= 0.8.3 |
Ongoing coverage of React2Shell