CVE-2025-65799: 
NixOS vulnerability analysis and mitigation

CVE-2025-65799 is a path traversal vulnerability in the Attachment service of usememos memos v0.25.2, caused by a lack of file name validation or verification. It was published on December 8, 2025, and affects memos versions prior to 0.25.3. The vulnerability carries a CVSS v3.1 base score of 4.3 (Moderate), requiring low privileges and no user interaction to exploit over the network (GitHub Advisory, Red Hat CVE).

The root cause is classified as CWE-73 (External Control of File Name or Path): the Attachment service in memos does not validate or sanitize user-supplied file names before using them in filesystem operations, enabling path traversal (GitHub Advisory). An authenticated low-privileged attacker can craft a malicious filename containing path traversal sequences (e.g., ../) and submit it via the CreateAttachment or UpdateAttachment API endpoints, causing the server to write files outside the intended attachment directory (GitHub PR #5218). The fix introduced a validateFilename function that rejects filenames containing path traversal attempts, directory separators, and filenames with leading/trailing spaces or periods (GitHub PR #5218). A proof-of-concept is publicly available via the usd HeroLab security advisory.

A low-privileged authenticated attacker can write files to arbitrary locations on the server's filesystem where the memos process has write permissions, potentially overwriting sensitive configuration files, planting malicious scripts, or corrupting application data (GitHub Advisory, GitHub PR #5218). The CVSS scoring reflects a low integrity impact with no direct confidentiality or availability impact; however, arbitrary file write in sensitive directories could enable privilege escalation or persistent access depending on the deployment environment.

A proof-of-concept exploit is publicly available via the usd HeroLab security advisory at https://herolab.usd.de/security-advisories/usd-2025-0056/, but there is no evidence of active in-the-wild exploitation at this time (Feedly). The EPSS score is approximately 0.046% (15th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a low-privileged account on the memos instance and is only applicable when attachments are stored on the local filesystem.

1. Reconnaissance: Identify a memos instance running version 0.25.2 or earlier with local filesystem attachment storage enabled.
2. Authenticate: Log in to the memos application with any low-privileged user account to obtain a valid session token.
3. Craft malicious filename: Prepare an attachment upload request with a filename containing path traversal sequences, such as ../../etc/cron.d/malicious or ../config/settings.json.
4. Submit the request: Send a crafted HTTP request to the CreateAttachment or UpdateAttachment API endpoint with the malicious filename, using the authenticated session.
5. Achieve arbitrary file write: The server, lacking filename validation, writes the uploaded file content to the attacker-controlled path outside the intended attachment directory, potentially overwriting sensitive files or planting malicious content (GitHub PR #5218, usd HeroLab).

• Network: Authenticated HTTP POST/PUT requests to the memos attachment API endpoints containing filenames with ../, ..\, or URL-encoded equivalents (%2e%2e%2f) in the filename parameter.
• Logs: Application or web server access logs showing attachment upload requests with suspicious filename values containing path traversal sequences; unexpected file creation events outside the configured attachment storage directory.
• File System: Unexpected files appearing in directories outside the memos attachment storage path (e.g., /etc/, /tmp/, application config directories) with timestamps matching attachment upload activity; modification timestamps on sensitive configuration files coinciding with memos API activity.

Users should upgrade usememos memos to version 0.25.3 or later, which introduces filename validation in the Attachment service rejecting path traversal attempts, directory separators, and filenames with leading/trailing spaces or periods (GitHub Advisory, GitHub PR #5218). As a temporary workaround for those unable to upgrade immediately, restrict filesystem permissions for the memos service account to limit write access strictly to the intended attachment directory, and consider using object storage (e.g., S3-compatible) instead of local filesystem storage to reduce the attack surface.

The vulnerability was discovered and reported by usd HeroLab, who published a detailed security advisory (usd HeroLab). The fix was contributed by community member FloDwld via a pull request and merged by the memos maintainer on November 5, 2025, prior to the CVE's public disclosure on December 8, 2025 (GitHub PR #5218). The vulnerability received routine coverage from vulnerability tracking platforms and no significant broader media attention, consistent with its moderate severity rating.