Executive brief
Dagu affected by unauthenticated RCE via inline DAG spec in default configuration
Affected products
- Go github.com/dagu-org/dagu
Junglewise Threat Intelligence
Dagu affected by unauthenticated RCE via inline DAG spec in default configuration
Severity: low · CVSS 3.1 · Published 2026-02-19
Technologies: github.com/dagu-org/dagu (Go). Vendors: Go.
Related threats
- GO-2026-4785 - Dagu has an incomplete fix for : path traversal via %2F-encoded slashes in locateDAG in github.com/dagu-org/dagu
- GO-2026-4693 - Dagu: Path Traversal via `dagRunId` in Inline DAG Execution in github.com/dagu-org/dagu
- GO-2026-4542 - Dagu: Path traversal in DAG creation allows arbitrary YAML file write outside DAGs directory in github.com/dagu-org/dagu
- GO-2026-4527 - Dagu affected by unauthenticated RCE via inline DAG spec in default configuration in github.com/dagu-org/dagu