CVE-2026-33344highCWE-22

CVE-2026-33344: falha de alta gravidade em dagu-org dagu

Dagu has an incomplete fix for CVE-2026-27598: path traversal via %2F-encoded slashes in locateDAG

Publicada em

Seguir esta CVE+ Monitorar dagu+ Monitorar github.com/dagu-org/dagu

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.1epss 0.5%
Dagu is a workflow engine with a built-in Web user interface. From version 2.0.0 to before version 2.3.1, the fix for CVE-2026-27598 added ValidateDAGName to CreateNewDAG and rewrote generateFilePath to use filepath.Base. This patched the CREATE path. The remaining API endpoints - GET, DELETE, RENAME, EXECUTE - all pass the {fileName} URL path parameter to locateDAG without calling ValidateDAGName. %2F-encoded forward slashes in the {fileName} segment traverse outside the DAGs directory. This issue has been patched in version 2.3.1.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Produtos afetados
dagu-org · dagu
CVEs relacionadas — dagu-org dagu

No mesmo produto, das mais perigosas para as menos.

CVE-2026-31882HIGHDagu SSE Authentication Bypass in Basic Auth ModeEPSS 0.8%CVE-2026-27598HIGHDagu: Path traversal in DAG creation allows arbitrary YAML file write outside DAGs directoryEPSS 0.6%CVE-2026-31886CRITICALDagu has a Path Traversal via `dagRunId` in Inline DAG ExecutionEPSS 0.4%