https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 15 Oct 2026 14:53:46 +0000 https://cve.radiocsirt.org/vuln/cve-2026-31886 <p><strong>Affected:</strong> dagu-org dagu</p> <p>Dagu is a workflow engine with a built-in Web user interface. Prior to 2.2.4, the dagRunId request field accepted by the inline DAG execution endpoints is passed directly into filepath.Join to construct a temporary directory path without any format validation. Go&#39;s filepath.Join resolves .. segments lexically, so a caller can supply a value such as &#34;..&#34; to redirect the computed directory outside the intended /tmp/&lt;name&gt;/&lt;id&gt; path. A deferred cleanup function that calls os.RemoveAll on that directory then runs unconditionally when the HTTP handler returns, deleting whatever directory the traversal resolved to. With dagRunId set to &#34;..&#34;, the resolved directory is the system temporary directory (/tmp on Linux). On non-root deployments, os.RemoveAll(&#34;/tmp&#34;) removes all files in /tmp owned by the dagu process user, disrupting every concurrent dagu run that has live temp files. On root or Docker deployments, the call removes the entire contents of /tmp, causing a system-wide denial of service. This vulnerability is fixed in 2.2.4.</p> <p><strong>Affected:</strong> dagu-org dagu</p> <p>Dagu is a workflow engine with a built-in Web user interface. Prior to 2.2.4, the dagRunId request field accepted by the inline DAG execution endpoints is passed directly into filepath.Join to construct a temporary directory path without any format validation. Go&#39;s filepath.Join resolves .. segments lexically, so a caller can supply a value such as &#34;..&#34; to redirect the computed directory outside the intended /tmp/&lt;name&gt;/&lt;id&gt; path. A deferred cleanup function that calls os.RemoveAll on that directory then runs unconditionally when the HTTP handler returns, deleting whatever directory the traversal resolved to. With dagRunId set to &#34;..&#34;, the resolved directory is the system temporary directory (/tmp on Linux). On non-root deployments, os.RemoveAll(&#34;/tmp&#34;) removes all files in /tmp owned by the dagu process user, disrupting every concurrent dagu run that has live temp files. On root or Docker deployments, the call removes the entire contents of /tmp, causing a system-wide denial of service. This vulnerability is fixed in 2.2.4.</p> https://cve.radiocsirt.org/vuln/cve-2026-31886