PT-2026-26485 · Dagu+1 · Dagu+1
Vnykmshr
·
Published
2026-03-19
·
Updated
2026-03-27
·
CVE-2026-33344
CVSS v3.1
8.1
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
dagu versions 2.0.0 through 2.3.0
Description
Dagu suffers from a path traversal issue due to incomplete fixes for CVE-2026-27598. The initial fix addressed path traversal in the
CreateNewDAG function, but the locateDAG function still allows traversal via %2F-encoded slashes. Specifically, the locateDAG function does not validate that the requested file path is within the expected directory, leading to arbitrary file read, delete, and potentially remote code execution. The issue arises because the Chi v5 router captures path segments containing encoded slashes, which are then decoded and passed to locateDAG without proper validation. This allows attackers to access files outside the intended DAGs directory. The findDAGFile function resolves the path using filepath.Abs and only checks for the YAML extension, without verifying containment within the base directory. Affected API endpoints include GET /dags/{fileName}/spec, DELETE /dags/{fileName}, and POST /dags/{fileName}/start, as well as other endpoints utilizing the {fileName} parameter. An authenticated user, or any user if authentication is disabled, can potentially read or delete arbitrary .yaml/.yml files on the server's filesystem. The locateDAG function is the core component affected.Recommendations
Versions 2.0.0 through 2.3.0 are vulnerable. Add path containment validation to the
locateDAG function to prevent access to files outside the intended directory. Reject file names containing path separators for all HTTP-facing callers. If the separator code path is required for internal worker communication, split locateDAG into a validated public method for HTTP handlers and an internal method for trusted callers only.Exploit
Fix
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Chi
Dagu