CVE-2025-50738 Scanner

Memos is an open-source note-taking and collaboration platform designed for developers and teams to efficiently manage, share, and retrieve information. It supports various file types, including SVG images, and is widely used for organizing resources and enhancing productivity. Its user-friendly interface and extensibility make it a popular choice for both personal and team-based projects.

The stored Cross-Site Scripting (XSS) vulnerability in Memos, identified as CVE-2025-50738, arises from inadequate sanitization of SVG files uploaded by authenticated users. When an SVG file containing malicious JavaScript is uploaded, the script is stored on the server and executed in the browser of any user who views the compromised content. This occurs because the application fails to properly escape or validate the SVG's embedded script elements.

Specifically, the vulnerability is triggered through the file upload functionality, where SVG files are accepted without stripping dangerous attributes like 'onload' or script tags. An attacker can craft an SVG file that, when rendered, executes arbitrary JavaScript in the context of the victim's session. The endpoint responsible for handling file uploads does not enforce strict content-type validation or sanitization of the SVG's XML structure.

If exploited, this vulnerability allows an attacker to steal session cookies, perform actions on behalf of the victim, deface the application, or redirect users to malicious sites. Given the CVSS score of 9.8, the impact is critical, potentially leading to full compromise of user accounts and data within the Memos environment. Immediate remediation is essential to protect users and maintain trust.