CVE-2025-50738

CriticalPublic PoC

Published: 29 July 2025

Published

29 July 2025

Modified

22 August 2025

KEV Added

—

Patch

—

CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0538 90.2th percentile

Risk Priority 23 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-50738 is a critical-severity Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) vulnerability in Usememos Memos. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 9.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-15 Information Output Filtering good match

prevent

Filters rendered markdown output in memos to block or proxy arbitrary external image URLs, preventing automatic browser fetches and information disclosure to attacker servers.

SI-10 Information Input Validation good match

prevent

Validates and sanitizes user-submitted memo content to reject or restrict embedding of arbitrary external image URLs during input processing.

SI-2 Flaw Remediation good match

prevent

Remediates the specific flaw in Memos up to v0.24.3 by identifying, testing, and installing vendor patches that fix arbitrary markdown image URL handling.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1592.004 Client Configurations Reconnaissance

Adversaries may gather information about the victim's client configurations that can be used during targeting.

attack.mitre.org →

Why these techniques?

Vulnerability in public-facing Memos app allows arbitrary external image URLs in memos, enabling unauthenticated attackers to trigger client info leaks (IP/User-Agent) on view for reconnaissance.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1

NVD Description

The Memos application, up to version v0.24.3, allows for the embedding of markdown images with arbitrary URLs. When a user views a memo containing such an image, their browser automatically fetches the image URL without explicit user consent or interaction…

beyond viewing the memo. This can be exploited by an attacker to disclose the viewing user's IP address, browser User-Agent string, and potentially other request-specific information to the attacker-controlled server, leading to information disclosure and user tracking.

Deeper analysisAI

CVE-2025-50738 is a critical vulnerability (CVSS v3.1 score of 9.8) in the Memos application, affecting versions up to v0.24.3 (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor). The issue stems from the application's support for embedding markdown images with arbitrary URLs. When a user views a memo containing such an image, their browser automatically fetches the image from the specified URL without requiring explicit user consent or any interaction beyond simply viewing the memo.

Any unauthenticated attacker (PR:N) with network access (AV:N) can exploit this vulnerability with low complexity (AC:L) and no user interaction (UI:N) by embedding a malicious image URL in a memo that points to a server they control. Victims viewing the memo will have their IP address, browser User-Agent string, and potentially other request-specific information (such as HTTP headers) disclosed to the attacker's server. This enables information disclosure and facilitates user tracking across sessions.

Mitigation details and patches are referenced in the following sources: the vulnerability research repository at https://github.com/fai1424/Vulnerability-Research/tree/main/CVE-2025-50738, the official Memos GitHub repository at https://github.com/usememos/memos, and a specific issue comment at https://github.com/usememos/memos/issues/4707#issuecomment-2898504237. Security practitioners should review these for upgrade guidance beyond v0.24.3 and implementation of controls to sanitize or restrict external image fetches.