beego 関連製品全体の CVE とセキュリティ脆弱性情報を集約し、CVSS、EPSS、公開日、脆弱性情報データを掲載しています。
過去の問題は主に パス処理の欠陥 and vendor risk cross-site scripting などに関し、一部は vendor impact session compromise を招き、vendor surface production workloads and vendor surface software deployment 関連の場面に影響します。
掲載データは公開脆弱性情報とセキュリティ公告に基づき、過去の暴露面と修補優先度の評価に利用できます。
| CVE | 概要 | ソース | CVSS 最大値 | EPSS（%） | 公開 | 更新 |
|---|---|---|---|---|---|---|
| CVE-2025-30223 | Beego is an open-source web framework for the Go programming language. Prior to 2.3.6, a Cross-Site Scripting (XSS) vulnerability exists in Beego's RenderForm() function due to improper HTML escaping of user-controlled data. This vulnerability allows attackers to inject malicious JavaScript code that executes in victims' browsers, potentially leading to session hijacking, credential theft, or account takeover. The vulnerability affects any application using Beego's RenderForm() function with use | [email protected] | 9.3 | 0.45% | 2025-03-31 | 2025-08-01 |
| CVE-2024-55885 | beego is an open-source web framework for the Go programming language. Versions of beego prior to 2.3.4 use MD5 as a hashing algorithm. MD5 is no longer considered secure against well-funded opponents due to its vulnerability to collision attacks. Version 2.3.4 replaces MD5 with SHA256. | [email protected] | 6.9 | 0.17% | 2024-12-12 | 2025-08-01 |
| CVE-2024-40465 | An issue in beego v.2.2.0 and before allows a remote attacker to escalate privileges via the getCacheFileName function in file.go file | [email protected] | 8.8 | 0.44% | 2024-07-31 | 2024-08-15 |
| CVE-2024-40464 | An issue in beego v.2.2.0 and before allows a remote attacker to escalate privileges via the sendMail function located in beego/core/logs/smtp.go file | [email protected] | 8.8 | 0.75% | 2024-07-31 | 2024-08-15 |
| CVE-2022-31836 | The leafInfo.match() function in Beego v2.0.3 and below uses path.join() to deal with wildcardvalues which can lead to cross directory risk. | [email protected] | 9.8 | 0.45% | 2022-07-05 | 2024-11-21 |
| CVE-2022-31259 | The route lookup process in beego before 1.12.9 and 2.x before 2.0.3 allows attackers to bypass access control. When a /p1/p2/:name route is configured, attackers can access it by appending .xml in various places (e.g., p1.xml instead of p1). | [email protected] | 9.8 | 0.15% | 2022-05-21 | 2024-11-21 |
| CVE-2021-30080 | An issue was discovered in the route lookup process in beego before 1.12.11 that allows attackers to bypass access control. | [email protected] | 9.8 | 0.41% | 2022-04-05 | 2024-11-21 |
| CVE-2021-27117 | An issue was discovered in file profile.go in function GetCPUProfile in beego through 2.0.2, allows attackers to launch symlink attacks locally. | [email protected] | 7.8 | 0.16% | 2022-04-05 | 2024-11-21 |
| CVE-2021-27116 | An issue was discovered in file profile.go in function MemProf in beego through 2.0.2, allows attackers to launch symlink attacks locally. | [email protected] | 7.8 | 0.16% | 2022-04-05 | 2024-11-21 |
| CVE-2021-39391 | Cross Site Scripting (XSS) vulnerability exists in the admin panel in Beego v2.0.1 via the URI path in an HTTP request, which is activated by administrators viewing the "Request Statistics" page. | [email protected] | 6.1 | 0.24% | 2021-09-14 | 2024-11-21 |
| CVE-2019-16355 | The File Session Manager in Beego 1.10.0 allows local users to read session files because of weak permissions for individual files. | [email protected] | 5.5 | 0.04% | 2019-09-16 | 2024-11-21 |
| CVE-2019-16354 | The File Session Manager in Beego 1.10.0 allows local users to read session files because there is a race condition involving file creation within a directory with weak permissions. | [email protected] | 4.7 | 0.04% | 2019-09-16 | 2024-11-21 |