Read the docs
TI-2021-08676 Aliases CVE-2021-27116GHSA-ffjp-66mx-3qpj

An issue was discovered in file profile.go in function MemProf in beego through 2.0.2…

Priority LOW 34CWE-59Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

An issue was discovered in file profile.go in function MemProf in beego through 2.0.2, allows attackers to launch symlink attacks locally.

Why it matters now

EPSS 0.00439 38th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed github.com/beego/beego/v2 (Go): 2.0.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—github.com/beego/beego/v2 (Go)2.0.0 to before 2.0.22.0.2Patch availableGHSA-ffjp-66mx-3qpj
—github.com/beego/beego (Go)all versions—No fix listedGHSA-ffjp-66mx-3qpj
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • github.com/beego/beego/v2 (Go) Vendor— Affected 2.0.0 to before 2.0.2 Fixed in 2.0.2 Patch available GHSA-ffjp-66mx-3qpj
  • github.com/beego/beego (Go) Vendor— Affected all versions Fixed in — No fix listed GHSA-ffjp-66mx-3qpj

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:beego:beego:*:*:*:*:*:*:*:*up to 2.0.2Vulnerablebeego
  • cpe:2.3:a:beego:beego:*:*:*:*:*:*:*:* Versions up to 2.0.2 Vulnerable ·beego

Remediation

  • Fix · GHSA-ffjp-66mx-3qpj github.com/beego/beego/v2 (Go) Fixed in 2.0.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-27116
  2. 2026-10-03 Alias added: GHSA-ffjp-66mx-3qpj

References

Exploit 1

Advisory 1

Other 1

  • TI-2025-21559 Beego allows Reflected/Stored XSS in Beego's RenderForm() Function Due to Unescaped User Input CVSS 3.1CRITICAL 9.6
  • TI-2022-13292 The route lookup process in beego before 1.12.9 and 2.x before 2.0.3 allows attackers to… CVSS 3.1CRITICAL 9.8
  • TI-2022-13707 The leafInfo.match() function in Beego v2.0.3 and below uses path.join() to deal with… CVSS 3.1CRITICAL 9.8
  • TI-2021-10653 An issue was discovered in the route lookup process in beego before 1.12.11 that allows… CVSS 3.1CRITICAL 9.8
  • TI-2024-26936 An issue in beego v.2.2.0 and before allows a remote attacker to escalate privileges via… CVSS 3.1HIGH 8.8
  • TI-2024-26937 An issue in beego v.2.2.0 and before allows a remote attacker to escalate privileges via… CVSS 3.1HIGH 8.8
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences