CVE-2025-50738: usememos memos
Vulnerability summary
CVE-2025-50738 is a critical (CVSS 9.8) vulnerability in usememos memos. EPSS estimates a 2.42% chance of exploitation in the next 30 days, higher than 84.2% of scored vulnerabilities. 1 public exploit is recorded.
Public exploit (GitHub, Date unknown)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 2 · Related 2Timeline
- 29-07-2025PublishedVulnerability first disclosed.
- 22-08-2025Last modifiedVulnerability information updated.
Description
The Memos application, up to version v0.24.3, allows for the embedding of markdown images with arbitrary URLs. When a user views a memo containing such an image, their browser automatically fetches the image URL without explicit user consent or interaction beyond viewing the memo. This can be exploited by an attacker to disclose the viewing user's IP address, browser User-Agent string, and potentially other request-specific information to the attacker-controlled server, leading to information disclosure and user tracking.
CVSS metrics
3 scores · 3 sources · 2 versions- NVDNIST9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
2.42%
Chance of exploitation in the next 30 days
Percentile
84%
Versus all other CVEs
30-day change
Increase +0.26 pp
From 2.16% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundMemos
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Github.com/usememos1 product
- memos< 0.24.4
Usememos1 product
- memos≤ 0.24.3
2 vendors · 2 products
