https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 14 Oct 2026 21:19:38 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-277284 EUVD-2026-277284 https://cve.radiocsirt.org/vuln/euvd-2026-277284 https://cve.radiocsirt.org/vuln/fkie_cve-2026-33344 <p>Dagu is a workflow engine with a built-in Web user interface. From version 2.0.0 to before version 2.3.1, the fix for CVE-2026-27598 added ValidateDAGName to CreateNewDAG and rewrote generateFilePath to use filepath.Base. This patched the CREATE path. The remaining API endpoints - GET, DELETE, RENAME, EXECUTE - all pass the {fileName} URL path parameter to locateDAG without calling ValidateDAGName. %2F-encoded forward slashes in the {fileName} segment traverse outside the DAGs directory. This issue has been patched in version 2.3.1.</p> <p>Dagu is a workflow engine with a built-in Web user interface. From version 2.0.0 to before version 2.3.1, the fix for CVE-2026-27598 added ValidateDAGName to CreateNewDAG and rewrote generateFilePath to use filepath.Base. This patched the CREATE path. The remaining API endpoints - GET, DELETE, RENAME, EXECUTE - all pass the {fileName} URL path parameter to locateDAG without calling ValidateDAGName. %2F-encoded forward slashes in the {fileName} segment traverse outside the DAGs directory. This issue has been patched in version 2.3.1.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-33344 https://cve.radiocsirt.org/vuln/ghsa-ph8x-4jfv-v9v8 <p><strong>Affected:</strong> Go: github.com/dagu-org/dagu</p> <p>The fix for CVE-2026-27598 (commit e2ed589, PR #1691) added `ValidateDAGName` to `CreateNewDAG` and rewrote `generateFilePath` to use `filepath.Base`. This patched the CREATE path. The remaining API endpoints - GET, DELETE, RENAME, EXECUTE - all pass the `{fileName}` URL path parameter to `locateDAG` without calling `ValidateDAGName`. `%2F`-encoded forward slashes in the `{fileName}` segment traverse outside the DAGs directory.</p> <p>### Vulnerable code</p> <p>`internal/persis/filedag/store.go`, lines 508-513:</p> <p>```go func (store *Storage) locateDAG(nameOrPath string) (string, error) { if strings.Contains(nameOrPath, string(filepath.Separator)) { foundPath, err := findDAGFile(nameOrPath) if err == nil { return foundPath, nil // returns arbitrary resolved path } } // ...safe searchPaths branch follows ```</p> <p>`findDAGFile` resolves the path with `filepath.Abs` and checks only that the file exists with a YAML extension. No containment check against `baseDir`.</p> <p>Chi v5 routes using `r.URL.RawPath` when set. The pattern `/dags/{fileName}/spec` captures `..%2F..%2Fetc%2Ftarget.yaml` as a single path segment. The oapi-codegen runtime calls `url.PathUnescape`, producing `../../etc/target.yaml`. This decoded string reaches `locateDAG` with the `/` separator intact.</p> <p>Go&#39;s `net/http.ServeMux` would normally redirect paths containing `..`, but dagu binds the chi mux directly to `&amp;http.Server{Handler: r}` (server.go:833-834), so no path cleaning fires.…</p> <p><strong>Affected:</strong> Go: github.com/dagu-org/dagu</p> <p>The fix for CVE-2026-27598 (commit e2ed589, PR #1691) added `ValidateDAGName` to `CreateNewDAG` and rewrote `generateFilePath` to use `filepath.Base`. This patched the CREATE path. The remaining API endpoints - GET, DELETE, RENAME, EXECUTE - all pass the `{fileName}` URL path parameter to `locateDAG` without calling `ValidateDAGName`. `%2F`-encoded forward slashes in the `{fileName}` segment traverse outside the DAGs directory.</p> <p>### Vulnerable code</p> <p>`internal/persis/filedag/store.go`, lines 508-513:</p> <p>```go func (store *Storage) locateDAG(nameOrPath string) (string, error) { if strings.Contains(nameOrPath, string(filepath.Separator)) { foundPath, err := findDAGFile(nameOrPath) if err == nil { return foundPath, nil // returns arbitrary resolved path } } // ...safe searchPaths branch follows ```</p> <p>`findDAGFile` resolves the path with `filepath.Abs` and checks only that the file exists with a YAML extension. No containment check against `baseDir`.</p> <p>Chi v5 routes using `r.URL.RawPath` when set. The pattern `/dags/{fileName}/spec` captures `..%2F..%2Fetc%2Ftarget.yaml` as a single path segment. The oapi-codegen runtime calls `url.PathUnescape`, producing `../../etc/target.yaml`. This decoded string reaches `locateDAG` with the `/` separator intact.</p> <p>Go&#39;s `net/http.ServeMux` would normally redirect paths containing `..`, but dagu binds the chi mux directly to `&amp;http.Server{Handler: r}` (server.go:833-834), so no path cleaning fires.…</p> https://cve.radiocsirt.org/vuln/ghsa-ph8x-4jfv-v9v8