CVE-2025-22952

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-22952
elestio memos v0.23.0 is vulnerable to Server-Side Request Forgery (SSRF) due to insufficient validation of user-supplied URLs, which can be exploited to perform SSRF attacks.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://elest.io/open-source/memos Product
https://github.com/usememos/memos Product
https://github.com/usememos/memos/issues/4413 Exploit Issue Tracking Vendor Advisory
https://github.com/usememos/memos/pull/4428 Issue Tracking Patch
https://github.com/usememos/memos/issues/4413 Exploit Issue Tracking Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:usememos:memos:0.23.0:-:*:*:*:*:*:*
History

10 Jul 2025, 22:52

Type Values Removed Values Added
References () https://elest.io/open-source/memos - () https://elest.io/open-source/memos - Product
References () https://github.com/usememos/memos - () https://github.com/usememos/memos - Product
References () https://github.com/usememos/memos/issues/4413 - () https://github.com/usememos/memos/issues/4413 - Exploit, Issue Tracking, Vendor Advisory
References () https://github.com/usememos/memos/pull/4428 - () https://github.com/usememos/memos/pull/4428 - Issue Tracking, Patch
CPE cpe:2.3:a:usememos:memos:0.23.0:-:*:*:*:*:*:*
First Time Usememos
Usememos memos

03 Mar 2025, 16:15

Type Values Removed Values Added
References () https://github.com/usememos/memos/issues/4413 - () https://github.com/usememos/memos/issues/4413 -
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 9.8
Summary
  • (es) elestio memos v0.23.0 es vulnerable a Server-Side Request Forgery (SSRF) debido a una validación insuficiente de las URL proporcionadas por el usuario, lo que puede explotarse para realizar ataques SSRF.
CWE CWE-918

27 Feb 2025, 20:16

Type Values Removed Values Added
New CVE
Information

Published : 2025-02-27 20:16

Updated : 2025-07-10 22:52

NVD link : CVE-2025-22952

Mitre link : CVE-2025-22952

CVE.ORG link : CVE-2025-22952

JSON object : View

Products Affected

usememos

  • memos
CWE
CWE-918

Server-Side Request Forgery (SSRF)