Read the docs
TI-2026-25750 Aliases CVE-2026-33344GHSA-ph8x-4jfv-v9v8

Dagu has an incomplete fix for CVE-2026-27598: path traversal via %2F-encoded slashes in locateDAG

Priority LOW 38CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

Dagu is a workflow engine with a built-in Web user interface. From version 2.0.0 to before version 2.3.1, the fix for CVE-2026-27598 added ValidateDAGName to CreateNewDAG and rewrote generateFilePath to use filepath.Base. This patched the CREATE path. The remaining API endpoints - GET, DELETE, RENAME, EXECUTE - all pass the {fileName} URL path parameter to locateDAG without calling ValidateDAGName. %2F-encoded forward slashes in the {fileName} segment traverse outside the DAGs directory. This issue has been patched in version 2.3.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00487 42nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed dagu (dagu-org): 2.3.1github.com/dagu-org/dagu (Go): 1.30.4-0.20260319093346-7d07fda8f9de

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
dagu-orgdagu2.0.0 to before 2.3.12.3.1Patch availableCNA
—github.com/dagu-org/dagu (Go)1.30.4-0.20260221021317-e2ed589105d7 to before 1.30.4-0.20260319093346-7d07fda8f9de1.30.4-0.20260319093346-7d07fda8f9dePatch availableGHSA-ph8x-4jfv-v9v8
  • dagu Vendordagu-org Affected 2.0.0 to before 2.3.1 Fixed in 2.3.1 Patch available CNA
  • github.com/dagu-org/dagu (Go) Vendor— Affected 1.30.4-0.20260221021317-e2ed589105d7 to before 1.30.4-0.20260319093346-7d07fda8f9de Fixed in 1.30.4-0.20260319093346-7d07fda8f9de Patch available GHSA-ph8x-4jfv-v9v8

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:dagu:dagu:*:*:*:*:*:*:*:*2.0.0 to before 2.3.1Vulnerabledagu-org
  • cpe:2.3:a:dagu:dagu:*:*:*:*:*:*:*:* Versions 2.0.0 to before 2.3.1 Vulnerable ·dagu-org

Remediation

  • Fix · CNA dagu (dagu-org) Fixed in 2.3.1
  • Fix · GHSA-ph8x-4jfv-v9v8 github.com/dagu-org/dagu (Go) Fixed in 1.30.4-0.20260319093346-7d07fda8f9de Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-33344
  2. 2026-10-03 Alias added: GHSA-ph8x-4jfv-v9v8

References

Exploit 1

Patch 1

Advisory 1

Other 1

  • TI-2026-24438 Dagu has a Path Traversal via `dagRunId` in Inline DAG Execution CVSS 3.1CRITICAL 9.1
  • TI-2026-24434 Dagu SSE Authentication Bypass in Basic Auth Mode CVSS 3.1HIGH 7.5
  • TI-2026-21984 Dagu: Path traversal in DAG creation allows arbitrary YAML file write outside DAGs directory CVSS 4.0HIGH 7.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences