CVE-2026-33344highCWE-22

CVE-2026-33344: high-severity vulnerability in dagu-org dagu

Dagu has an incomplete fix for CVE-2026-27598: path traversal via %2F-encoded slashes in locateDAG

Published

Follow this CVE+ Monitor dagu+ Monitor github.com/dagu-org/dagu

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.1epss 0.5%
Dagu is a workflow engine with a built-in Web user interface. From version 2.0.0 to before version 2.3.1, the fix for CVE-2026-27598 added ValidateDAGName to CreateNewDAG and rewrote generateFilePath to use filepath.Base. This patched the CREATE path. The remaining API endpoints - GET, DELETE, RENAME, EXECUTE - all pass the {fileName} URL path parameter to locateDAG without calling ValidateDAGName. %2F-encoded forward slashes in the {fileName} segment traverse outside the DAGs directory. This issue has been patched in version 2.3.1.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Affected products
dagu-org · dagu
Related CVEs — dagu-org dagu

In the same product, most dangerous first.

CVE-2026-31882HIGHDagu SSE Authentication Bypass in Basic Auth ModeEPSS 0.8%CVE-2026-27598HIGHDagu: Path traversal in DAG creation allows arbitrary YAML file write outside DAGs directoryEPSS 0.6%CVE-2026-31886CRITICALDagu has a Path Traversal via `dagRunId` in Inline DAG ExecutionEPSS 0.4%