CVE-2025-56760
📋 TL;DR
This vulnerability allows attackers to write arbitrary files to the server when Memos 0.22 is configured with local storage. Attackers can exploit the CreateResource endpoint using path traversal sequences in filenames, potentially compromising server integrity. Only Memos instances with local storage configuration are affected.
💻 Affected Systems
- Memos
📦 What is this software?
Memos by Usememos
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise through overwriting critical system files, installation of backdoors, or privilege escalation.
Likely Case
Defacement of the Memos application, data corruption, or denial of service by overwriting application files.
If Mitigated
Limited to writing files within the application's data directory if proper input validation is implemented.
🎯 Exploit Status
Requires attacker to have access to the CreateResource endpoint and knowledge of local storage configuration
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.24.4 or later
Vendor Advisory: https://github.com/usememos/memos/blob/v0.24.4/server/router/api/v1/resource_service.go#L48
Restart Required: No
Instructions:
1. Backup your Memos data. 2. Update to Memos version 0.24.4 or later. 3. Verify the fix by checking that path traversal sequences are properly sanitized.
🔧 Temporary Workarounds
Switch to external storage
allConfigure Memos to use external object storage (like S3, MinIO) instead of local storage
Modify configuration to set storage.type to 's3' or similar external storage
Input validation middleware
allAdd middleware to sanitize filename inputs before processing
Implement filename sanitization in the resource upload handler
🧯 If You Can't Patch
- Implement strict file permission controls on the Memos data directory
- Deploy a WAF with path traversal detection rules
🔍 How to Verify
Check if Vulnerable:
Check if running Memos version 0.22 with local storage configurationCheck Version:
Check Memos version in web interface or configuration filesVerify Fix Applied:
Attempt to upload a file with path traversal sequences (e.g., '../../etc/passwd') and verify it's rejected or sanitized📡 Detection & Monitoring
Log Indicators:
- Unusual file creation patterns
- Requests with path traversal sequences in filenames
- Failed file write attempts outside expected directories
Network Indicators:
- HTTP POST requests to CreateResource endpoint with suspicious filenames
SIEM Query:
source="memos" AND (filename="*../*" OR filename="*..\\*")