CVE-2025-22952

The vulnerability (CWE-918) involves the application accepting URLs from users and performing server-side requests based on them without proper verification. An attacker can supply a crafted URL pointing to internal network resources (e.g., services accessible only locally, cloud environment metadata). The lack of filtering of allowed schemes, hosts, and IP address ranges enables circumvention of perimeter security and access to resources unavailable directly from the outside.

An attacker can gain access to internal infrastructure resources (confidentiality, integrity, availability — all rated as HIGH), including network services not exposed publicly, potentially leading to further compromise of the environment.

Apply patches available from the vendor according to the references — the fix has been submitted in pull request #4428 in the usememos/memos GitHub repository. It is recommended to update to a version containing this patch and implement firewall rules restricting outgoing connections from the application server to trusted hosts.

Usememos Memos v0.23.0 (elestio distribution)