The File Session Manager in Beego 1.10.0 allows local users to read session files because…
Priority LOW 25CWE-276Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.
Summary
The File Session Manager in Beego 1.10.0 allows local users to read session files because of weak permissions for individual files.
Why it matters now
EPSS 0.00362 30th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed github.com/beego/beego (Go): 1.12.2github.com/astaxie/beego (Go): 1.12.2
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | github.com/beego/beego (Go) | before 1.12.2 | 1.12.2 | Patch available | GHSA-hf4p-4j9r-3cvx |
| — | github.com/astaxie/beego (Go) | before 1.12.2 | 1.12.2 | Patch available | GHSA-hf4p-4j9r-3cvx |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- github.com/beego/beego (Go) Vendor— Affected before 1.12.2 Fixed in 1.12.2 Patch available GHSA-hf4p-4j9r-3cvx
- github.com/astaxie/beego (Go) Vendor— Affected before 1.12.2 Fixed in 1.12.2 Patch available GHSA-hf4p-4j9r-3cvx
Remediation
- Fix · GHSA-hf4p-4j9r-3cvx github.com/beego/beego (Go) Fixed in 1.12.2 Advisory →
- Fix · GHSA-hf4p-4j9r-3cvx github.com/astaxie/beego (Go) Fixed in 1.12.2 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2019-16355
- 2026-10-03 Alias added: GHSA-hf4p-4j9r-3cvx
References
More Beego vulnerabilities
- TI-2025-21559 Beego allows Reflected/Stored XSS in Beego's RenderForm() Function Due to Unescaped User Input CVSS 3.1CRITICAL 9.6
- TI-2022-13292 The route lookup process in beego before 1.12.9 and 2.x before 2.0.3 allows attackers to… CVSS 3.1CRITICAL 9.8
- TI-2022-13707 The leafInfo.match() function in Beego v2.0.3 and below uses path.join() to deal with… CVSS 3.1CRITICAL 9.8
- TI-2021-10653 An issue was discovered in the route lookup process in beego before 1.12.11 that allows… CVSS 3.1CRITICAL 9.8
- TI-2024-26936 An issue in beego v.2.2.0 and before allows a remote attacker to escalate privileges via… CVSS 3.1HIGH 8.8
- TI-2024-26937 An issue in beego v.2.2.0 and before allows a remote attacker to escalate privileges via… CVSS 3.1HIGH 8.8
Sources
- CVE-2019-16355 · CVE Program
- CVE-2019-16355 · NVD
- FIRST EPSS
- GHSA-hf4p-4j9r-3cvx · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences