CVE-2025-50738: Memos has Cross-Site Scripting (XSS) Vulnerability in Image URLs

The vulnerability lies in the handling of user-uploaded files in the Memos application. An attacker could upload a file with a crafted content type (e.g., image/svg+xml) that contains malicious scripts. When another user's browser attempts to render this file, the script would execute, leading to a Cross-Site Scripting (XSS) attack. The provided commit patch addresses this issue in the GetResourceBinary function within server/router/api/v1/resource_service.go. The patch adds a check to identify potentially harmful content types and forces them to be served as application/octet-stream. This change ensures that browsers will treat the file as a downloadable binary rather than a renderable and potentially executable file, thus preventing the XSS attack. The vulnerable function is therefore APIV1Service.GetResourceBinary as it was the function responsible for serving the user-uploaded content without proper validation.