Executive brief
Dagu has an incomplete fix for CVE-2026-27598: path traversal via %2F-encoded slashes in locateDAG in github.com/dagu-org/dagu
Affected products
- Go github.com/dagu-org/dagu
Junglewise Threat Intelligence
CVE-2026-33344: GO-2026-4785 - Dagu has an incomplete fix for : path traversal via %2F-encoded slashes in locateDAG in github.com/dagu-org/dagu
CVE-2026-33344 · Severity: low · CVSS 3.1 · Published 2026-03-23
Technologies: github.com/dagu-org/dagu (Go). Vendors: Go.
Related threats
- GO-2026-4693 - Dagu: Path Traversal via `dagRunId` in Inline DAG Execution in github.com/dagu-org/dagu
- GO-2026-4542 - Dagu: Path traversal in DAG creation allows arbitrary YAML file write outside DAGs directory in github.com/dagu-org/dagu
- GO-2026-4527 - Dagu affected by unauthenticated RCE via inline DAG spec in default configuration in github.com/dagu-org/dagu
- Dagu affected by unauthenticated RCE via inline DAG spec in default configuration