CVE-2026-27598 Dagu: Path traversal in DAG creation allows arbitrary YAML file write outside DAGs directory
An authenticated user can exploit path traversal in the DAG creation API to write arbitrary files, potentially leading to remote code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-27598?
CVE-2026-27598 is a high-severity path traversal vulnerability in dagu-org dagu, published on 25 Feb 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Dagu is a workflow engine with a built-in Web user interface. In versions up to and including 1.16.7, the `CreateNewDAG` API endpoint (`POST /api/v1/dags`) does not validate the DAG name before passing it to the file store. An authenticated user with DAG write permissions can write arbitrary YAML files anywhere on the filesystem (limited by the process permissions). Since dagu executes DAG files as shell commands, writing a malicious DAG to the DAGs directory of another instance or overwriting config files can lead to remote code execution. Commit e2ed589105d79273e4e6ac8eb31525f765bb3ce4 fixes the issue.
Weakness: CWE-22
Which versions are affected by CVE-2026-27598?
3 open source packages ship an affected version, including github.com/dagu-org/dagu. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/dagu-org/dagu Go | All versions | None |
github.com/dagu-org/dagu Go | All versions to 1.16.7 | None |
github.com/dagu-org/dagu Go | All versions to 1.16.7 | None |
Products include Dagu Dagu.
How do I fix CVE-2026-27598?
Apply the vendor's patch.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-27598 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-27598 exists.
Other vulnerabilities in dagu-org dagu
Sources
Also known as GHSA-6v48-fcq6-ff23, GO-2026-4542.