Stored XSS via attacker-controlled upload content types

Stored XSS in Memos 0.22.0 allows remote authenticated users to execute script in an administrator's browser through an attachment or avatar. The CreateResource path stores attacker-supplied file bytes and MIME type, while avatar handling trusts the MIME type embedded in a data URL; both are served from the application origin without restricting executable content. A low-privileged account must upload the payload and an administrator must view it, after which the script runs with the administrator's session privileges.