Skip to content
OpenAdvisories

Vendor

dagu-org

4 known vulnerabilities.

Products

dagu 4
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 8.1
    CVE-2026-33344

    Dagu has an incomplete fix for CVE-2026-27598: path traversal via %2F-encoded slashes in locateDAG

    Dagu is a workflow engine with a built-in Web user interface. From version 2.0.0 to before version 2.3.1, the fix for CVE-2026-27598 added ValidateDAGName to CreateNewDAG and rewrote generateFilePath to use filepath.Base. This patched the CREATE path. The rem…

    dagu-org dagu github.com/dagu-org/dagu Go
  • High 7.5
    CVE-2026-31882

    Dagu SSE Authentication Bypass in Basic Auth Mode

    Dagu is a workflow engine with a built-in Web user interface. Prior to 2.2.4, when Dagu is configured with HTTP Basic authentication (DAGU_AUTH_MODE=basic), all Server-Sent Events (SSE) endpoints are accessible without any credentials. This allows unauthentic…

    dagu-org dagu dagu npm
  • High 7.1
    CVE-2026-27598

    Dagu: Path traversal in DAG creation allows arbitrary YAML file write outside DAGs directory

    Dagu is a workflow engine with a built-in Web user interface. In versions up to and including 1.16.7, the `CreateNewDAG` API endpoint (`POST /api/v1/dags`) does not validate the DAG name before passing it to the file store. An authenticated user with DAG writ…

    dagu-org dagu github.com/dagu-org/dagu Go