CVE-2024-40465: Beego privilege escalation vulnerability
Summary
CVE-2024-40465: Beego privilege escalation vulnerability. Affects github.com/beego/beego/v2 versions < 2.2.1. Fixed in 2.2.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Beego is a Go web application framework that provides a simple and elegant way to build web applications. It offers features such as routing, middleware, and session management. The vulnerability affects beego version 2.2.0 and earlier. This vulnerability allows a remote attacker to escalate privileges by exploiting the getCacheFileName function in the file.go file.
Vulnerability Detail
The vulnerability arises from a flaw in the getCacheFileName function of beego. By exploiting this flaw, an attacker can gain elevated privileges. This can lead to unauthorized access, data manipulation, or even a complete compromise of the affected system. The vulnerability has a CVSS score of 8.8, indicating a high severity level.
How To Fix
Latest published version: v2.3.10 as of 23 Oct 2026
go get github.com/beego/beego/v2@v2.3.10Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.2.1
This is the first release that contains the fix.
go get github.com/beego/beego/v2@v2.2.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update to the patched version of beego to mitigate the risk.
Conclusion
The beego privilege escalation vulnerability (CVE-2024-40465) allows a remote attacker to gain elevated privileges by exploiting a flaw in the getCacheFileName function. To mitigate this vulnerability, it is essential to update to beego version 2.2.1 or later. Failure to do so may result in unauthorized access, data manipulation, or a complete compromise of the affected system.
See every vulnerability recorded for github.com/beego/beego/v2 →
FAQ
Beego is a Go web application framework that simplifies the process of building web applications. It provides features such as routing, middleware, and session management.
This vulnerability allows a remote attacker to escalate privileges, potentially leading to unauthorized access, data manipulation, or a complete compromise of the affected system.
The CVSS score of this vulnerability is 8.8, indicating a high severity level.
To fix this vulnerability, it is recommended to upgrade to beego version 2.2.1 or later.
There is no known workaround for this vulnerability. It is crucial to update to the patched version of beego to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/beego/beego/v2.
