{"answers":{"affected":"3 open source packages ship an affected version, including github.com/dagu-org/dagu. It affects 1 product.","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-27598 exists.","fix":"Apply the vendor's patch.","what":"CVE-2026-27598 is a high-severity path traversal vulnerability in dagu-org dagu, published on 25 Feb 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link."},"fix_prompt":"Check this codebase for CVE-2026-27598 and fix it if it is affected.\n\nWhat it is: CVE-2026-27598 is a high-severity path traversal vulnerability in dagu-org dagu, published on 25 Feb 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-27598 exists.\n\nAffected packages and fixed versions:\n- github.com/dagu-org/dagu (Go): affected all versions; no fix listed\n- github.com/dagu-org/dagu (Go): affected all versions up to 1.16.7; no fix listed\n- github.com/dagu-org/dagu (Go): affected all versions up to 1.16.7; no fix listed\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-27598/ (Markdown: https://insights.sbomify.com/CVE-2026-27598/index.md)","id":"CVE-2026-27598","markdown":"https://insights.sbomify.com/CVE-2026-27598/index.md","name":"CVE-2026-27598","record":{"aliases":["GHSA-6v48-fcq6-ff23","GO-2026-4542"],"analysis":{"component_type":"server_software","fix_type":"patch","impacts":["code_execution","data_modify"],"network_reachable":"yes","non_default_config":false,"product_category":"Dagu workflow engine","requires_auth":"none","summary":"An authenticated user can exploit path traversal in the DAG creation API to write arbitrary files, potentially leading to remote code execution.","user_interaction":"required","vuln_class":"path_traversal"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[{"product":"dagu","vendor":"dagu"}],"cvss":{"score":7.1,"severity":"high","source":"cna","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","version":"4.0"},"cwes":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory"}],"description":"Dagu is a workflow engine with a built-in Web user interface. In versions up to and including 1.16.7, the `CreateNewDAG` API endpoint (`POST /api/v1/dags`) does not validate the DAG name before passing it to the file store. An authenticated user with DAG write permissions can write arbitrary YAML files anywhere on the filesystem (limited by the process permissions). Since dagu executes DAG files as shell commands, writing a malicious DAG to the DAGs directory of another instance or overwriting config files can lead to remote code execution. Commit e2ed589105d79273e4e6ac8eb31525f765bb3ce4 fixes the issue.","ecosystems":["Go"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"weaponised"},"has_fix":true,"headline":"Dagu: Path traversal in DAG creation allows arbitrary YAML file write outside DAGs directory","id":"CVE-2026-27598","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Go","product":null,"products":[],"type":"path_traversal","year":"2026"},"n_packages":3,"n_references":2,"next":{"headline":"ci4-cms-erp/ci4ms: System Settings (Mail Settings) Full Platform Compromise \u0026 Full Account Takeover for All-Roles \u0026 Privilege-Escalation via Stored DOM XSS","id":"CVE-2026-27599"},"packages":[{"ecosystem":"Go","fixed":[],"introduced":["0"],"last_affected":[],"package":"github.com/dagu-org/dagu","purl":"pkg:golang/github.com/dagu-org/dagu","source":"GO-2026-4542"},{"ecosystem":"Go","fixed":[],"introduced":["0"],"last_affected":["1.16.7"],"package":"github.com/dagu-org/dagu","purl":null,"source":"GHSA-6v48-fcq6-ff23"},{"ecosystem":"Go","fixed":[],"introduced":["0"],"last_affected":["1.16.7"],"package":"github.com/dagu-org/dagu","purl":"pkg:golang/github.com/dagu-org/dagu","source":"GHSA-6v48-fcq6-ff23"}],"prev":{"headline":"@enclave-vm/core is vulnerable to Sandbox Escape","id":"CVE-2026-27597"},"products":["dagu"],"published":"2026-02-25","related":[{"cvss_score":9.1,"headline":"Dagu has a Path Traversal via `dagRunId` in Inline DAG Execution","id":"CVE-2026-31886","kev_date_added":null,"published":"2026-03-13"},{"cvss_score":8.1,"headline":"Dagu has an incomplete fix for CVE-2026-27598: path traversal via %2F-encoded slashes in locateDAG","id":"CVE-2026-33344","kev_date_added":null,"published":"2026-03-24"},{"cvss_score":7.5,"headline":"Dagu SSE Authentication Bypass in Basic Auth Mode","id":"CVE-2026-31882","kev_date_added":null,"published":"2026-03-13"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CC BY 4.0","name":"Go Vulnerability Database","prefix":"GO"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"poc","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-02-26","vendors":["dagu-org"]},"summary":"An authenticated user can exploit path traversal in the DAG creation API to write arbitrary files, potentially leading to remote code execution.","url":"https://insights.sbomify.com/CVE-2026-27598/"}