Skip to content
OpenAdvisories

Package · Go

github.com/dagu-org/dagu

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 8.1
    CVE-2026-33344

    Dagu has an incomplete fix for CVE-2026-27598: path traversal via %2F-encoded slashes in locateDAG

    Dagu is a workflow engine with a built-in Web user interface. From version 2.0.0 to before version 2.3.1, the fix for CVE-2026-27598 added ValidateDAGName to CreateNewDAG and rewrote generateFilePath to use filepath.Base. This patched the CREATE path. The rem…

    dagu-org dagu github.com/dagu-org/dagu Go
  • High 7.1
    CVE-2026-27598

    Dagu: Path traversal in DAG creation allows arbitrary YAML file write outside DAGs directory

    Dagu is a workflow engine with a built-in Web user interface. In versions up to and including 1.16.7, the `CreateNewDAG` API endpoint (`POST /api/v1/dags`) does not validate the DAG name before passing it to the file store. An authenticated user with DAG writ…

    dagu-org dagu github.com/dagu-org/dagu Go