CVE-2025-65799 - A lack of file name validation or verification in the Attachment service of usememos memos v0.25.2 allows attackers to execute a path traversal

MEDIUM

A lack of file name validation or verification in the Attachment service of usememos memos v0.25.2 allows attackers to execute a path traversal

Published Dec 8, 2025

4.3

MEDIUM

CVSS 3.1

EPSS 0.21%

A lack of file name validation or verification in the Attachment service of usememos memos v0.25.2 allows attackers to execute a path traversal.

Ecosystem	Package	Introduced	Fixed
Go	github.com/usememos/memos	0	0.25.3

No remediation recorded yet.

Weaknesses (1)

CWE-73

Link	Providers	Tags
http://memos.com
http://usememos.com
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-201721		Advisory
https://github.com/advisories/GHSA-qgjp-5g5x-vhq2		Advisory
https://github.com/usememos/memos/commit/5f57f48673e2054f404b2c5b497a8eaa3690591d
https://github.com/usememos/memos/pull/5218		Issue TrackingPatch
https://herolab.usd.de/security-advisories/usd-2025-0056		ExploitThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-65799