Beego is a widely used open-source web application framework for Go that has attracted attention in the vulnerability landscape despite a narrow product footprint, with its disclosures skewing strongly toward critical-severity outcomes. The recurring vulnerabilities center on input handling and cryptographic weaknesses—including link-following conditions, cross-site scripting, weak hashing practices, and use of broken cryptographic algorithms—that reflect the challenges of web-framework design and secure-by-default configuration in library code. Defenders integrating Beego should prioritize framework updates and conduct code reviews around input sanitization and cryptographic defaults; live exploitation and severity figures are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Beego over time
Signals from CVEs in this vendor scope (12 CVEs).
12 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2022-31259CRITICAL The route lookup process in beego before 1.12.9 and 2.x before 2.0.3 allows attackers to bypass access control. When a /p1/p2/:name route is configured, attackers can access it by | May 21, 2022 | 9.8 | 42 | NO | NO |
CVE-2022-31836CRITICAL The leafInfo.match() function in Beego v2.0.3 and below uses path.join() to deal with wildcardvalues which can lead to cross directory risk. | Jul 5, 2022 | 9.8 | 31 | NO | NO |
CVE-2021-30080CRITICAL An issue was discovered in the route lookup process in beego before 1.12.11 that allows attackers to bypass access control. | Apr 5, 2022 | 9.8 | 30 | NO | NO |
CVE-2025-30223CRITICAL Beego is an open-source web framework for the Go programming language. Prior to 2.3.6, a Cross-Site Scripting (XSS) vulnerability exists in Beego's RenderForm() function due to imp | Mar 31, 2025 | 9.6 | 29 | NO | NO |
CVE-2021-27117HIGH An issue was discovered in file profile.go in function GetCPUProfile in beego through 2.0.2, allows attackers to launch symlink attacks locally. | Apr 5, 2022 | 7.8 | 25 | NO | NO |
CVE-2021-27116HIGH An issue was discovered in file profile.go in function MemProf in beego through 2.0.2, allows attackers to launch symlink attacks locally. | Apr 5, 2022 | 7.8 | 25 | NO | NO |
CVE-2024-40465HIGH An issue in beego v.2.2.0 and before allows a remote attacker to escalate privileges via the getCacheFileName function in file.go file | Jul 31, 2024 | 8.8 | 24 | NO | NO |
CVE-2024-40464HIGH An issue in beego v.2.2.0 and before allows a remote attacker to escalate privileges via the sendMail function located in beego/core/logs/smtp.go file | Jul 31, 2024 | 8.8 | 24 | NO | NO |
CVE-2024-55885HIGH beego is an open-source web framework for the Go programming language. Versions of beego prior to 2.3.4 use MD5 as a hashing algorithm. MD5 is no longer considered secure against w | Dec 12, 2024 | 7.5 | 21 | NO | NO |
CVE-2021-39391MEDIUM Cross Site Scripting (XSS) vulnerability exists in the admin panel in Beego v2.0.1 via the URI path in an HTTP request, which is activated by administrators viewing the "Request St | Sep 14, 2021 | 6.1 | 21 | NO | NO |
Signals from CVEs in this vendor scope (12 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Beego.
Media articles that mention a CVE ID that affects a product developed by Beego — matched by CVE ID, not by vendor name.