Affected by GO-2025-3492 and 3 other vulnerabilities

GO-2025-3492: Memos Server-Side Request Forgery (SSRF) in github.com/usememos/memos

GO-2025-3936: Memos Vulnerable to Path Traversal via the CreateResource Endpoint in github.com/usememos/memos

GO-2025-3937: Memos Vulnerable to Stored Cross-Site Scripting in github.com/usememos/memos

GO-2025-4127: Memos' Access Tokens Stay Valid after User Password Change in github.com/usememos/memos

plugin/

Details

Path	Synopsis
cron
email Package email provides SMTP email sending functionality for self-hosted Memos instances.	Package email provides SMTP email sending functionality for self-hosted Memos instances.
filter
httpgetter
idp
oauth2 Package oauth2 is the plugin for OAuth2 Identity Provider.	Package oauth2 is the plugin for OAuth2 Identity Provider.
markdown
ast
extensions
parser
renderer
scheduler Package scheduler provides a GitHub Actions-inspired cron job scheduler.	Package scheduler provides a GitHub Actions-inspired cron job scheduler.
storage
s3
webhook