CVE-2025-22952

Memos Server-Side Request Forgery (SSRF)

9.8 CriticalFix available

elestio memos v0.23.0 is vulnerable to Server-Side Request Forgery (SSRF) due to insufficient validation of user-supplied URLs, which can be exploited to perform SSRF attacks.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

2.93%Up 2.9 points since Feb 28, 2025

What each source reports

CVE List Score used 9.8

elestio memos v0.23.0 is vulnerable to Server-Side Request Forgery (SSRF) due to insufficient validation of user-supplied URLs, which can be exploited to perform SSRF attacks.

Record: CVE-2025-22952
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-918
Updated: 2026-11-02

EUVDEUVD-2025-5566 9.8

elestio memos v0.23.0 is vulnerable to Server-Side Request Forgery (SSRF) due to insufficient validation of user-supplied URLs, which can be exploited to perform SSRF attacks.

Record: EUVD-2025-5566
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-wfxg-v3j4-7qmj 6.9

Memos Server-Side Request Forgery (SSRF)

elestio memos v0.23.0 is vulnerable to Server-Side Request Forgery (SSRF) due to insufficient validation of user-supplied URLs, which can be exploited to perform SSRF attacks.

Record: GHSA-wfxg-v3j4-7qmj
CVSS 4.0: 6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Weakness: CWE-918
Updated: 2026-11-02

NVD 9.8

elestio memos v0.23.0 is vulnerable to Server-Side Request Forgery (SSRF) due to insufficient validation of user-supplied URLs, which can be exploited to perform SSRF attacks.

Record: CVE-2025-22952
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-918
Updated: 2026-11-02

OSV 9.8

elestio memos v0.23.0 is vulnerable to Server-Side Request Forgery (SSRF) due to insufficient validation of user-supplied URLs, which can be exploited to perform SSRF attacks.

Record: CVE-2025-22952
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVGHSA-wfxg-v3j4-7qmj 6.9

Memos Server-Side Request Forgery (SSRF)

elestio memos v0.23.0 is vulnerable to Server-Side Request Forgery (SSRF) due to insufficient validation of user-supplied URLs, which can be exploited to perform SSRF attacks.

Record: GHSA-wfxg-v3j4-7qmj
CVSS 4.0: 6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Weakness: CWE-918
Updated: 2026-11-02

OSVGO-2025-3492 No score

Memos Server-Side Request Forgery (SSRF) in github.com/usememos/memos

Memos Server-Side Request Forgery (SSRF) in github.com/usememos/memos

Record: GO-2025-3492
Updated: 2026-11-02

OSVopenSUSE-SU-2025:14889-1 No score

govulncheck-vulndb-0.0.20250312T181707-1.1 on GA media

These are all security issues fixed in the govulncheck-vulndb-0.0.20250312T181707-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2025:14889-1
Updated: 2026-11-02

Affected products

usememos memos

Affected packages

Affected packages
Package	Affected	Fixed
`github.com/usememos/memos` Go	through 0.24.0	None known
`github.com/usememos/memos` Go	All versions	None known
`govulncheck-vulndb` openSUSE:Tumbleweed	before 0.0.20250312T181707-1.1	0.0.20250312T181707-1.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Nuclei	Elestio Memos <= v0.24.0 - Server-Side Request Forgery

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, Nuclei, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-22952 is a critical vulnerability (CVSS 9.8) in Usememos Memos, published February 27, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.93%, the 87th percentile. Fixed in govulncheck-vulndb 0.0.20250312T181707-1.1.

References

Show 35 moreShow less