Skip to content
OpenAdvisories

Package · Go

github.com/dagu-org/dagu

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Feed

  • High 8.1
    CVE-2026-33344

    Dagu has an incomplete fix for CVE-2026-27598: path traversal via %2F-encoded slashes in locateDAG

    Dagu is a workflow engine with a built-in Web user interface. From version 2.0.0 to before version 2.3.1, the fix for CVE-2026-27598 added ValidateDAGName to CreateNewDAG and rewrote generateFilePath to use filepath.Base. This patched the CREATE path. The rem…

    dagu-org dagu github.com/dagu-org/dagu Go
  • Critical 9.1
    CVE-2026-31886

    Dagu has a Path Traversal via `dagRunId` in Inline DAG Execution

    Dagu is a workflow engine with a built-in Web user interface. Prior to 2.2.4, the dagRunId request field accepted by the inline DAG execution endpoints is passed directly into filepath.Join to construct a temporary directory path without any format validation…

    dagu-org dagu github.com/dagu-org/dagu Go
  • High 7.1
    CVE-2026-27598

    Dagu: Path traversal in DAG creation allows arbitrary YAML file write outside DAGs directory

    Dagu is a workflow engine with a built-in Web user interface. In versions up to and including 1.16.7, the `CreateNewDAG` API endpoint (`POST /api/v1/dags`) does not validate the DAG name before passing it to the file store. An authenticated user with DAG writ…

    dagu-org dagu github.com/dagu-org/dagu Go
  • Critical 9.8
    GHSA-6qr9-g2xw-cw92

    Dagu affected by unauthenticated RCE via inline DAG spec in default configuration

    ### Summary Dagu's default configuration ships with authentication disabled. The `POST /api/v2/dag-runs` endpoint accepts an inline YAML spec and executes its shell commands immediately with no credentials required — any dagu instance reachable over the netwo…

    github.com/dagu-org/dagu Go