Dagu-org vulnerabilities
We track 3 vulnerabilities in Dagu-org products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on March 24, 2026.
Latest Dagu-org vulnerabilities
- 8.1 High severity
dagu: Improper Limitation of a Pathname to a Restricted Directory
Dagu is a workflow engine with a built-in Web user interface. From version 2.0.0 to before version 2.3.1, the fix for CVE-2026-27598 added ValidateDAGName to CreateNewDAG and rewrote generateFilePath to use filepath.Base. This patched the CREATE path. The rema
- 7.6 High severity
dagu: Improper Limitation of a Pathname to a Restricted Directory
Dagu is a workflow engine with a built-in Web user interface. Prior to 2.2.4, the dagRunId request field accepted by the inline DAG execution endpoints is passed directly into filepath.Join to construct a temporary directory path without any format validation.
- 7.5 High severity
dagu: Missing Authentication for Critical Functionality
Dagu is a workflow engine with a built-in Web user interface. Prior to 2.2.4, when Dagu is configured with HTTP Basic authentication (DAGU_AUTH_MODE=basic), all Server-Sent Events (SSE) endpoints are accessible without any credentials. This allows unauthentica