PatchTheCVEmemos vulnerabilities and fixes
Recent CVEs affecting memos, with upgrade or downgrade steps. 15 tracked.
memos has 15 tracked vulnerabilities, 2 critical. A fixed release or vendor patch exists for 7. Most recent: 2025-12-08. Highest priority: CVE-2025-22952 (score 69/100).
- CVE-2025-65798 MEDIUM 5.4 DOWNGRADE Incorrect access control in usememos memos v0.25.2 allows attackers with low-level privileges to arbitrarily m
- CVE-2025-65796 MEDIUM 4.3 DOWNGRADE Incorrect access control in usememos memos v0.25.2 allows attackers with low-level privileges to arbitrarily d
- CVE-2025-65799 MEDIUM 4.3 DOWNGRADE A lack of file name validation or verification in the Attachment service of usememos memos v0.25.2 allows atta
- CVE-2025-65795 HIGH 7.5 DOWNGRADE Incorrect access control in the /api/v1/user endpoint of usememos memos v0.25.2 allows unauthorized attackers
- CVE-2025-65797 MEDIUM 6.5 DOWNGRADE Incorrect access control in the Identity Provider service of usememos memos v0.25.2 allows attackers with low-
- CVE-2024-21635 HIGH 7.5 UPGRADE Memos is a privacy-first, lightweight note-taking service that uses Access Tokens to authenticate application
- CVE-2025-56761 MEDIUM 5.4 DOWNGRADE Memos 0.22 is vulnerable to Stored Cross site scripting (XSS) vulnerabilities by the upload attachment and use
- CVE-2025-56760 MEDIUM 4.3 DOWNGRADE When Memos 0.22 is configured to store objects locally, an attacker can create a file via the CreateResource e
- CVE-2025-50738 CRITICAL 9.8 UPGRADE The Memos application, up to version v0.24.3, allows for the embedding of markdown images with arbitrary URLs
- CVE-2025-22952 CRITICAL 9.8 DOWNGRADE elestio memos v0.23.0 is vulnerable to Server-Side Request Forgery (SSRF) due to insufficient validation of us
- CVE-2024-41659 HIGH 8.1 UPGRADE memos is a privacy-first, lightweight note-taking service
- CVE-2024-29030 MEDIUM 5.8 UPGRADE memos is a privacy-first, lightweight note-taking service
- CVE-2024-29029 MEDIUM 6.1 UPGRADE memos is a privacy-first, lightweight note-taking service
- CVE-2024-29028 MEDIUM 5.8 UPGRADE memos is a privacy-first, lightweight note-taking service
- CVE-2023-0109 MEDIUM 5.4 DOWNGRADE A stored cross-site scripting (XSS) vulnerability was discovered in usememos/memos version 0.9.1
FAQ
How do I fix memos vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is memos being exploited right now?
None of the tracked memos CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which memos CVE should I patch first?
CVE-2025-22952 currently ranks highest (69/100): elestio memos v0.23.0 is vulnerable to Server-Side Request Forgery (SSRF) due to insufficient validation of us.