5.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-56761

CVE-2025-56761: Memos Vulnerable to Stored Cross-Site Scripting

Memos 0.22 is vulnerable to Stored Cross site scripting (XSS) vulnerabilities by the upload attachment and user avatar features. Memos does not verify the content type of the uploaded data and serve it back as is. An authenticated attacker can use this to elevate their privileges when the stored XSS is viewed by an admin.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-56761

CVE-2025-56761:

5.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/usememos/memos	go	<= 0.22.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, CVE-2025-56761, is a stored Cross-Site Scripting (XSS) issue in Memos <= 0.22.0, caused by the application's failure to validate the content type of user-uploaded data in two distinct features: user avatars and file attachments.

User Avatar XSS: An attacker can exploit the UpdateUser function to set their avatar to a data: URL containing a JavaScript payload and a text/html MIME type. The GetUserAvatarBinary function, which relies on the flawed extractImageInfo helper function, later serves this avatar to other users. It reads the attacker-specified text/html content type and uses it in the HTTP response, causing the victim's browser to execute the script. This provides a clear path for a stored XSS attack.
Attachment XSS: The CreateResource function allows an authenticated user to upload a file and set an arbitrary content type. The vulnerability description confirms that Memos serves this file back 'as is'. This means the unvalidated, user-provided content type is used in the Content-Type header when the file is viewed. An attacker can upload a file containing a script, set the type to text/html, and when another user (e.g., an administrator) views the file, the script executes in their browser.

Both vectors allow an authenticated attacker to execute arbitrary scripts in the context of a victim's browser, which can be leveraged to steal session tokens, perform unauthorized actions, or chain with other vulnerabilities for a full server compromise.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.