Executive brief
Dagu: Path traversal in DAG creation allows arbitrary YAML file write outside DAGs directory in github.com/dagu-org/dagu
Affected products
- Go github.com/dagu-org/dagu
Junglewise Threat Intelligence
CVE-2026-27598: GO-2026-4542 - Dagu: Path traversal in DAG creation allows arbitrary YAML file write outside DAGs directory in github.com/dagu-org/dagu
CVE-2026-27598 · Severity: medium · CVSS 4 · Published 2026-02-25
Technologies: github.com/dagu-org/dagu (Go). Vendors: Go.
Related threats
- GO-2026-4785 - Dagu has an incomplete fix for : path traversal via %2F-encoded slashes in locateDAG in github.com/dagu-org/dagu
- GO-2026-4693 - Dagu: Path Traversal via `dagRunId` in Inline DAG Execution in github.com/dagu-org/dagu
- GO-2026-4527 - Dagu affected by unauthenticated RCE via inline DAG spec in default configuration in github.com/dagu-org/dagu
- Dagu affected by unauthenticated RCE via inline DAG spec in default configuration