https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-15T04:16:23.598905+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-33344 CVE-2026-33344 — Dagu has an incomplete fix for CVE-2026-27598: path traversal via %2F-encoded slashes in locateDAG 2026-10-15T04:16:23.600045+00:00

Affected: dagu-org dagu

Dagu is a workflow engine with a built-in Web user interface. From version 2.0.0 to before version 2.3.1, the fix for CVE-2026-27598 added ValidateDAGName to CreateNewDAG and rewrote generateFilePath to use filepath.Base. This patched the CREATE path. The remaining API endpoints - GET, DELETE, RENAME, EXECUTE - all pass the {fileName} URL path parameter to locateDAG without calling ValidateDAGName. %2F-encoded forward slashes in the {fileName} segment traverse outside the DAGs directory. This issue has been patched in version 2.3.1.