The File Session Manager in Beego 1.10.0 allows local users to read session files because…
Priority LOW 21CWE-362Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.
Summary
The File Session Manager in Beego 1.10.0 allows local users to read session files because there is a race condition involving file creation within a directory with weak permissions.
Why it matters now
EPSS 0.00199 9th percentileScored 2026-11-07
Fix Fixed github.com/beego/beego (Go): 1.12.2github.com/astaxie/beego (Go): 1.12.2
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | github.com/beego/beego (Go) | before 1.12.2 | 1.12.2 | Patch available | GHSA-f6px-w8rh-7r89 |
| — | github.com/astaxie/beego (Go) | before 1.12.2 | 1.12.2 | Patch available | GHSA-f6px-w8rh-7r89 |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- github.com/beego/beego (Go) Vendor— Affected before 1.12.2 Fixed in 1.12.2 Patch available GHSA-f6px-w8rh-7r89
- github.com/astaxie/beego (Go) Vendor— Affected before 1.12.2 Fixed in 1.12.2 Patch available GHSA-f6px-w8rh-7r89
Remediation
- Fix · GHSA-f6px-w8rh-7r89 github.com/beego/beego (Go) Fixed in 1.12.2 Advisory →
- Fix · GHSA-f6px-w8rh-7r89 github.com/astaxie/beego (Go) Fixed in 1.12.2 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2019-16354
- 2026-10-03 Alias added: GHSA-f6px-w8rh-7r89
References
Advisory 2
Other 8
- https://github.com/beego/beego/issues/3763
- https://github.com/beego/beego/pull/3975
- https://github.com/beego/beego/pull/3975/commits/f99cbe0fa40936f2f8dd28e70620c559b6e5e2fd
- https://github.com/astaxie/beego/commit/f99cbe0fa40936f2f8dd28e70620c559b6e5e2fd
- https://github.com/beego/beego/commit/bac2b31afecc65d9a89f9e473b8006c5edc0c8d1
- https://github.com/astaxie/beego
- https://github.com/astaxie/beego/blob/v1.12.2/session/sess_file.go#L142
- https://pkg.go.dev/vuln/GO-2021-0084
More Beego vulnerabilities
- TI-2025-21559 Beego allows Reflected/Stored XSS in Beego's RenderForm() Function Due to Unescaped User Input CVSS 3.1CRITICAL 9.6
- TI-2022-13292 The route lookup process in beego before 1.12.9 and 2.x before 2.0.3 allows attackers to… CVSS 3.1CRITICAL 9.8
- TI-2022-13707 The leafInfo.match() function in Beego v2.0.3 and below uses path.join() to deal with… CVSS 3.1CRITICAL 9.8
- TI-2021-10653 An issue was discovered in the route lookup process in beego before 1.12.11 that allows… CVSS 3.1CRITICAL 9.8
- TI-2024-26936 An issue in beego v.2.2.0 and before allows a remote attacker to escalate privileges via… CVSS 3.1HIGH 8.8
- TI-2024-26937 An issue in beego v.2.2.0 and before allows a remote attacker to escalate privileges via… CVSS 3.1HIGH 8.8
Sources
- CVE-2019-16354 · CVE Program
- CVE-2019-16354 · NVD
- FIRST EPSS
- GHSA-f6px-w8rh-7r89 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences