CVE-2019-16354: Data race in Beego
Summary
CVE-2019-16354: Beego has a file creation race condition. Affects github.com/beego/beego versions < 1.12.2. Fixed in 1.12.2. How to fix ↓
Also tracked for
The same CVE-2019-16354 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Beego is a Go-based open-source web application framework that provides a simple and flexible structure to build web applications. It offers features such as routing, session management, and template rendering. The File Session Manager in Beego 1.10.0 is vulnerable to a data race issue, which can be exploited by local users to read session files. This vulnerability occurs due to a race condition during file creation within a directory with weak permissions.
Vulnerability Detail
The data race vulnerability in Beego can allow unauthorized local users to read session files. By exploiting the race condition during file creation, an attacker can gain access to sensitive session data. This can lead to unauthorized access to user accounts, session hijacking, and potential exposure of sensitive information. The vulnerability has a CVSS score of 4.7, indicating a moderate severity level.
How To Fix
Latest published version: v1.12.14 as of 22 Oct 2026
go get github.com/beego/beego@v1.12.14Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.12.2
This is the first release that contains the fix.
go get github.com/beego/beego@v1.12.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can manually set strong permissions for the session file directory to prevent unauthorized access. This can be achieved by using appropriate file system permissions and access controls. However, applying the fix by upgrading to the latest version is the recommended long-term solution.
Conclusion
The data race vulnerability in Beego can be mitigated by upgrading to version 1.12.2 or above. It is important to promptly apply the fix to ensure the security of session files and prevent unauthorized access. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/beego/beego →
FAQ
Beego is an open-source web application framework for building web applications in Go. It provides a simple and flexible structure with features like routing, session management, and template rendering.
The vulnerability allows local users to read session files, potentially leading to unauthorized access to user accounts and exposure of sensitive information.
To fix this vulnerability, upgrade to Beego version 1.12.2 or above. This version includes a fix for the data race issue.
As a temporary workaround, you can manually set strong permissions for the session file directory to prevent unauthorized access.
The vulnerability has a CVSS score of 4.7, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/beego/beego.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
