Affected by GO-2025-3492 and 4 other vulnerabilities

GO-2025-3492: Memos Server-Side Request Forgery (SSRF) in github.com/usememos/memos

GO-2025-3936: Memos Vulnerable to Path Traversal via the CreateResource Endpoint in github.com/usememos/memos

GO-2025-3937: Memos Vulnerable to Stored Cross-Site Scripting in github.com/usememos/memos

GO-2025-4127: Memos' Access Tokens Stay Valid after User Password Change in github.com/usememos/memos

GO-2026-5403: Memos has an Incorrect Privilege Assignment issue in github.com/usememos/memos

server

package

v0.31.0-rc.1 Latest Latest Go to latest Published: Aug 30, 2026 License: MIT Imports: 20 Imported by: 0

Details

This section is empty.

This section is empty.

This section is empty.

type Server struct {
	Secret  string
	Profile *profile.Profile
	Store   *store.Store
	// contains filtered or unexported fields
}

func NewServer(ctx context.Context, profile *profile.Profile, store *store.Store) (*Server, error)

func (s *Server) Shutdown(ctx context.Context)

func (s *Server) Start() error

Path	Synopsis
access Package access defines transport-independent resource authorization policies shared by the server's API and HTTP adapters.	Package access defines transport-independent resource authorization policies shared by the server's API and HTTP adapters.
auth Package auth provides authentication and authorization for the Memos server.	Package auth provides authentication and authorization for the Memos server.
notification
router
api/v1
api/v1/test
fileserver
frontend
mcp
runner
memopayload