CVE-2025-65799

MEDIUM EPSS 13.6%
Published Dec 8, 20256mo ago · Modified Jun 17, 20262w ago
4.3 CVSS 3.1
Medium
Find Similar
Published Dec 8, 2025 6mo ago
Last Modified Jun 17, 2026 2w ago

Description

A lack of file name validation or verification in the Attachment service of usememos memos v0.25.2 allows attackers to execute a path traversal.

CVSS Details

Base Score
4.3
Exploitability
2.8
Impact
1.4
Vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality None
Integrity Low
Availability None

Threat Intelligence

EPSS Exploit Probability
13.6% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 1

CWE-73

Affected Products 1

VendorProductVersionRange
usememosmemos0.25.2any

References 4

  • memos.com http://memos.com
    Permissions Required
  • usememos.com http://usememos.com
    Product
  • github.com https://github.com/usememos/memos/pull/5218
    Issue TrackingPatch
  • herolab.usd.de https://herolab.usd.de/security-advisories/usd-2025-0056/
    ExploitThird Party Advisory

Remediation

  • github.com https://github.com/usememos/memos/pull/5218
    Issue TrackingPatch