CVE-2025-56760

Name of the Vulnerable Software and Affected Versions Memos version 0.22

Description When configured to store objects locally, the software allows an attacker to create a file via the CreateResource endpoint. This is achieved by including a path traversal sequence in the file name, enabling arbitrary file write on the server.

Recommendations As a temporary workaround, restrict access to the CreateResource endpoint until a patch is available.