CVE-2025-22952

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-22952
elestio memos v0.23.0 is vulnerable to Server-Side Request Forgery (SSRF) due to insufficient validation of user-supplied URLs, which can be exploited to perform SSRF attacks.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://elest.io/open-source/memos Product
https://github.com/usememos/memos Product
https://github.com/usememos/memos/issues/4413 Exploit Issue Tracking Vendor Advisory
https://github.com/usememos/memos/pull/4428 Issue Tracking Patch
https://github.com/usememos/memos/issues/4413 Exploit Issue Tracking Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:usememos:memos:0.23.0:-:*:*:*:*:*:*
History

No history.

Information

Published : 2025-02-27 20:16

Updated : 2025-07-10 22:52

NVD link : CVE-2025-22952

Mitre link : CVE-2025-22952

CVE.ORG link : CVE-2025-22952

JSON object : View

Products Affected

usememos

  • memos
CWE
CWE-918

Server-Side Request Forgery (SSRF)