https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 15 Oct 2026 16:15:38 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-276018 EUVD-2026-276018 https://cve.radiocsirt.org/vuln/euvd-2026-276018 https://cve.radiocsirt.org/vuln/fkie_cve-2026-31886 <p>Dagu is a workflow engine with a built-in Web user interface. Prior to 2.2.4, the dagRunId request field accepted by the inline DAG execution endpoints is passed directly into filepath.Join to construct a temporary directory path without any format validation. Go&#39;s filepath.Join resolves .. segments lexically, so a caller can supply a value such as &#34;..&#34; to redirect the computed directory outside the intended /tmp/&lt;name&gt;/&lt;id&gt; path. A deferred cleanup function that calls os.RemoveAll on that directory then runs unconditionally when the HTTP handler returns, deleting whatever directory the traversal resolved to. With dagRunId set to &#34;..&#34;, the resolved directory is the system temporary directory (/tmp on Linux). On non-root deployments, os.RemoveAll(&#34;/tmp&#34;) removes all files in /tmp owned by the dagu process user, disrupting every concurrent dagu run that has live temp files. On root or Docker deployments, the call removes the entire contents of /tmp, causing a system-wide denial of service. This vulnerability is fixed in 2.2.4.</p> <p>Dagu is a workflow engine with a built-in Web user interface. Prior to 2.2.4, the dagRunId request field accepted by the inline DAG execution endpoints is passed directly into filepath.Join to construct a temporary directory path without any format validation. Go&#39;s filepath.Join resolves .. segments lexically, so a caller can supply a value such as &#34;..&#34; to redirect the computed directory outside the intended /tmp/&lt;name&gt;/&lt;id&gt; path. A deferred cleanup function that calls os.RemoveAll on that directory then runs unconditionally when the HTTP handler returns, deleting whatever directory the traversal resolved to. With dagRunId set to &#34;..&#34;, the resolved directory is the system temporary directory (/tmp on Linux). On non-root deployments, os.RemoveAll(&#34;/tmp&#34;) removes all files in /tmp owned by the dagu process user, disrupting every concurrent dagu run that has live temp files. On root or Docker deployments, the call removes the entire contents of /tmp, causing a system-wide denial of service. This vulnerability is fixed in 2.2.4.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-31886 https://cve.radiocsirt.org/vuln/ghsa-m4q3-457p-hh2x <p><strong>Affected:</strong> Go: github.com/dagu-org/dagu</p> <p>## 1. Vulnerability Summary</p> <p>The `dagRunId` request field accepted by the inline DAG execution endpoints is passed directly into `filepath.Join` to construct a temporary directory path without any format validation. Go&#39;s `filepath.Join` resolves `..` segments lexically, so a caller can supply a value such as `&#34;..&#34;` to redirect the computed directory outside the intended `/tmp/&lt;name&gt;/&lt;id&gt;` path. A deferred cleanup function that calls `os.RemoveAll` on that directory then runs unconditionally when the HTTP handler returns, deleting whatever directory the traversal resolved to.</p> <p>With `dagRunId` set to `&#34;..&#34;`, the resolved directory is the system temporary directory (`/tmp` on Linux). On non-root deployments, `os.RemoveAll(&#34;/tmp&#34;)` removes all files in `/tmp` owned by the dagu process user, disrupting every concurrent dagu run that has live temp files. On root or Docker deployments, the call removes the entire contents of `/tmp`, causing a system-wide denial of service.</p> <p>## 2. This Is Not a Duplicate of Existing Advisories</p> <p>Two security advisories are already published for dagu. This vulnerability is distinct from both.</p> <p>**GHSA-6qr9-g2xw-cw92** fixed the fact that the default authentication mode was `none`, allowing unauthenticated access to the inline execution endpoint. That advisory covers authentication bypass. The `dagRunId` path traversal described here is a separate input-validation flaw in `loadInlineDAG()` that exists regardless of whether authentication is required an…</p> <p><strong>Affected:</strong> Go: github.com/dagu-org/dagu</p> <p>## 1. Vulnerability Summary</p> <p>The `dagRunId` request field accepted by the inline DAG execution endpoints is passed directly into `filepath.Join` to construct a temporary directory path without any format validation. Go&#39;s `filepath.Join` resolves `..` segments lexically, so a caller can supply a value such as `&#34;..&#34;` to redirect the computed directory outside the intended `/tmp/&lt;name&gt;/&lt;id&gt;` path. A deferred cleanup function that calls `os.RemoveAll` on that directory then runs unconditionally when the HTTP handler returns, deleting whatever directory the traversal resolved to.</p> <p>With `dagRunId` set to `&#34;..&#34;`, the resolved directory is the system temporary directory (`/tmp` on Linux). On non-root deployments, `os.RemoveAll(&#34;/tmp&#34;)` removes all files in `/tmp` owned by the dagu process user, disrupting every concurrent dagu run that has live temp files. On root or Docker deployments, the call removes the entire contents of `/tmp`, causing a system-wide denial of service.</p> <p>## 2. This Is Not a Duplicate of Existing Advisories</p> <p>Two security advisories are already published for dagu. This vulnerability is distinct from both.</p> <p>**GHSA-6qr9-g2xw-cw92** fixed the fact that the default authentication mode was `none`, allowing unauthenticated access to the inline execution endpoint. That advisory covers authentication bypass. The `dagRunId` path traversal described here is a separate input-validation flaw in `loadInlineDAG()` that exists regardless of whether authentication is required an…</p> https://cve.radiocsirt.org/vuln/ghsa-m4q3-457p-hh2x