Affected by GO-2025-3492 and 4 other vulnerabilities

GO-2025-3492: Memos Server-Side Request Forgery (SSRF) in github.com/usememos/memos

GO-2025-3936: Memos Vulnerable to Path Traversal via the CreateResource Endpoint in github.com/usememos/memos

GO-2025-3937: Memos Vulnerable to Stored Cross-Site Scripting in github.com/usememos/memos

GO-2025-4127: Memos' Access Tokens Stay Valid after User Password Change in github.com/usememos/memos

GO-2026-5403: Memos has an Incorrect Privilege Assignment issue in github.com/usememos/memos

internal/

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/usememos/memos

Links

README ¶

internal

Private plumbing with no memos vocabulary. A package belongs here only if it could be published tomorrow as a standalone module without changes: it imports nothing from store, core, server, provider, markdown, filter, or proto/gen. The depguard rules in .golangci.yaml enforce that.

Package	Purpose
`clientip/`	trusted-proxy aware client IP resolution middleware
`email/`	SMTP client, config, and message types
`identifier/`	grammar of UIDs and usernames shared by parser, store, and API
`linkmeta/`	HTML metadata, oEmbed, and image fetching for link previews
`motionphoto/`	Live Photo and Motion Photo container parsing
`profile/`	process configuration parsed from flags and environment
`random/`	UUIDs and random strings from a secure source
`ratelimit/`	sliding-window rate limiter
`testutil/`	test fixtures and the fake S3 server (the one package allowed to import `proto/gen`)
`version/`	build version and version comparison
`webhook/`	signed webhook delivery with SSRF protection

Do not add util, common, base, or helpers packages. Name a package for the one thing it does, or put the code next to its only caller.

Directories ¶

Path	Synopsis
clientip Package clientip resolves the client address of a request from the connection peer and, only when that peer is a trusted proxy, from the forwarding headers it set.	Package clientip resolves the client address of a request from the connection peer and, only when that peer is a trusted proxy, from the forwarding headers it set.
email Package email provides SMTP email sending functionality for self-hosted Memos instances.	Package email provides SMTP email sending functionality for self-hosted Memos instances.
identifier
linkmeta
motionphoto
profile
random Package random generates identifiers and secrets from a cryptographically secure source.	Package random generates identifiers and secrets from a cryptographically secure source.
ratelimit Package ratelimit bounds how often a caller may do something.	Package ratelimit bounds how often a caller may do something.
testutil
fakes3 Package fakes3 provides an in-process S3-compatible service for tests.	Package fakes3 provides an in-process S3-compatible service for tests.
version
webhook

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL