Affected by GO-2025-3492 and 3 other vulnerabilities

GO-2025-3492: Memos Server-Side Request Forgery (SSRF) in github.com/usememos/memos

GO-2025-3936: Memos Vulnerable to Path Traversal via the CreateResource Endpoint in github.com/usememos/memos

GO-2025-3937: Memos Vulnerable to Stored Cross-Site Scripting in github.com/usememos/memos

GO-2025-4127: Memos' Access Tokens Stay Valid after User Password Change in github.com/usememos/memos

memos

module

v0.27.0-rc.1 Latest Latest Go to latest Published: Mar 31, 2026 License: MIT

Details

Open-source, self-hosted note-taking tool built for quick capture. Markdown-native, lightweight, and fully yours.

Warp — The AI-powered terminal built for speed and collaboration

TestMu AI - The world’s first full-stack Agentic AI Quality Engineering platform

SSD Nodes - Affordable VPS hosting for self-hosters

Instant Capture — Timeline-first UI. Open, write, done — no folders to navigate.
Total Data Ownership — Self-hosted on your infrastructure. Notes stored in Markdown, always portable. Zero telemetry.
Radical Simplicity — Single Go binary, ~20MB Docker image. One command to deploy with SQLite, MySQL, or PostgreSQL.
Open & Extensible — MIT-licensed with full REST and gRPC APIs for integration.

docker run -d \
  --name memos \
  -p 5230:5230 \
  -v ~/.memos:/var/opt/memos \
  neosmemo/memos:stable

Open http://localhost:5230 and start writing!

curl -fsSL https://raw.githubusercontent.com/usememos/memos/main/scripts/install.sh | sh

Don't want to install yet? Try our live demo first!

See our installation guide for detailed instructions.

Contributions are welcome — bug reports, feature suggestions, pull requests, documentation, and translations.

Memos is open-source software licensed under the MIT License. See our Privacy Policy for details on data handling.

Website • Documentation • Demo • Discord • X/Twitter

Path	Synopsis
cmd
memos command
internal
base
profile
util
version
plugin
cron
email Package email provides SMTP email sending functionality for self-hosted Memos instances.	Package email provides SMTP email sending functionality for self-hosted Memos instances.
filter
httpgetter
idp
idp/oauth2 Package oauth2 is the plugin for OAuth2 Identity Provider.	Package oauth2 is the plugin for OAuth2 Identity Provider.
markdown
markdown/ast
markdown/extensions
markdown/parser
markdown/renderer
scheduler Package scheduler provides a GitHub Actions-inspired cron job scheduler.	Package scheduler provides a GitHub Actions-inspired cron job scheduler.
storage/s3
webhook
proto
gen/api/v1 Package apiv1 is a reverse proxy.	Package apiv1 is a reverse proxy.
gen/api/v1/apiv1connect
gen/store
server
auth Package auth provides authentication and authorization for the Memos server.	Package auth provides authentication and authorization for the Memos server.
router/api/v1
router/api/v1/test
router/fileserver
router/frontend
router/mcp
router/rss
runner/memopayload
runner/s3presign
store
cache
db
db/mysql
db/postgres
db/sqlite Package sqlite provides SQLite driver implementation with custom functions.	Package sqlite provides SQLite driver implementation with custom functions.
test