What’s Vulnerable › Vulnerabilities

CVE-2026-33344: Dagu has an incomplete fix for CVE-2026-27598: path traversal via %2F-encoded slashes in locateDAG

• Severity: high (CVSS 8.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-03-24 · updated 2026-06-17
• Weakness: CWE-22

Description

Dagu is a workflow engine with a built-in Web user interface. From version 2.0.0 to before version 2.3.1, the fix for CVE-2026-27598 added ValidateDAGName to CreateNewDAG and rewrote generateFilePath to use filepath.Base. This patched the CREATE path. The remaining API endpoints - GET, DELETE, RENAME, EXECUTE - all pass the {fileName} URL path parameter to locateDAG without calling ValidateDAGName. %2F-encoded forward slashes in the {fileName} segment traverse outside the DAGs directory. This issue has been patched in version 2.3.1.

Affected products

• dagu-org dagu: from 2.0.0 before 2.3.1 — fixed in 2.3.1

How to fix

Upgrade to a fixed version: dagu-org dagu 2.3.1. Check the vendor advisory for mitigations.

References

• https://github.com/dagu-org/dagu/commit/7d07fda8f9de3ae73dfb081ccd0639f8059c56bb
• https://github.com/dagu-org/dagu/security/advisories/GHSA-ph8x-4jfv-v9v8

Get alerted when CVE-2026-33344 or the next vulnerability affects your stack