Vulnerabilities

TI-2026-25750 CVE-2026-33344 · GHSA-ph8x-4jfv-v9v8

Dagu has an incomplete fix for CVE-2026-27598: path traversal via %2F-encoded slashes in locateDAG

LOW 38

Dagu is a workflow engine with a built-in Web user interface.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00487 Published 2026-03-24 Fixed in 2.3.1, 1.30.4-0.20260319093346-7d07fda8f9de CWE-22

TI-2026-24438 CVE-2026-31886 · GHSA-m4q3-457p-hh2x

HIGH 72

Dagu is a workflow engine with a built-in Web user interface.

CVSS 3.1CRITICAL 9.1 Network Low privileges No interaction EPSS 0.00465 Published 2026-03-13 Fixed in 2.2.4 CWE-22

TI-2026-24434 CVE-2026-31882 · GHSA-9wmw-9wph-2vwp

HIGH 66

Dagu is a workflow engine with a built-in Web user interface.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00884 Published 2026-03-13 Fixed in 2.2.4 CWE-306

TI-2026-21984 CVE-2026-27598 · GHSA-6v48-fcq6-ff23

MEDIUM 64

Dagu is a workflow engine with a built-in Web user interface.

CVSS 4.0HIGH 7.1 Network No auth User interaction EPSS 0.00649 Published 2026-02-25 No fix listed CWE-22