Affected by GO-2025-3492 and 4 other vulnerabilities

GO-2025-3492: Memos Server-Side Request Forgery (SSRF) in github.com/usememos/memos

GO-2025-3936: Memos Vulnerable to Path Traversal via the CreateResource Endpoint in github.com/usememos/memos

GO-2025-3937: Memos Vulnerable to Stored Cross-Site Scripting in github.com/usememos/memos

GO-2025-4127: Memos' Access Tokens Stay Valid after User Password Change in github.com/usememos/memos

GO-2026-5403: Memos has an Incorrect Privilege Assignment issue in github.com/usememos/memos

internal/

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/usememos/memos

Links

Directories ¶

Path	Synopsis
ai
audio Package audio provides audio container/codec helpers for AI providers.	Package audio provides audio container/codec helpers for AI providers.
audiollm Package audiollm defines the multimodal-audio capability for AI providers.	Package audiollm defines the multimodal-audio capability for AI providers.
audiollm/gemini Package gemini implements audiollm.Model against the Gemini generateContent endpoint.	Package gemini implements audiollm.Model against the Gemini generateContent endpoint.
stt Package stt defines the speech-to-text capability for AI providers.	Package stt defines the speech-to-text capability for AI providers.
stt/openai Package openai implements stt.Transcriber against the OpenAI /audio/transcriptions endpoint (and any compatible third-party endpoint such as Groq Whisper, faster-whisper self-hosted, or Azure Whisper).	Package openai implements stt.Transcriber against the OpenAI /audio/transcriptions endpoint (and any compatible third-party endpoint such as Groq Whisper, faster-whisper self-hosted, or Azure Whisper).
base
email Package email provides SMTP email sending functionality for self-hosted Memos instances.	Package email provides SMTP email sending functionality for self-hosted Memos instances.
filter
httpgetter
idp
oauth2 Package oauth2 implements the OAuth2 identity provider integration.	Package oauth2 implements the OAuth2 identity provider integration.
markdown
ast
extensions
parser
parser/tagdata command Command tagdata generates the fixed Unicode and emoji tables used by the Memos tag lexer.	Command tagdata generates the fixed Unicode and emoji tables used by the Memos tag lexer.
renderer
motionphoto
profile
scheduler Package scheduler provides a GitHub Actions-inspired cron job scheduler.	Package scheduler provides a GitHub Actions-inspired cron job scheduler.
storage
s3
testutil
fakes3 Package fakes3 provides an in-process S3-compatible service for tests.	Package fakes3 provides an in-process S3-compatible service for tests.
minio Package minio provides a real S3-compatible service backed by a MinIO Testcontainer for integration tests.	Package minio provides a real S3-compatible service backed by a MinIO Testcontainer for integration tests.
util
version
webhook

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL