CVE-2026-31886 Dagu has a Path Traversal via `dagRunId` in Inline DAG Execution
Attackers can delete system temporary files via path traversal in Dagu, causing denial of service for concurrent runs or the entire system.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-31886?
CVE-2026-31886 is a critical path traversal vulnerability in dagu-org dagu, published on 13 Mar 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Dagu is a workflow engine with a built-in Web user interface. Prior to 2.2.4, the dagRunId request field accepted by the inline DAG execution endpoints is passed directly into filepath.Join to construct a temporary directory path without any format validation. Go's filepath.Join resolves .. segments lexically, so a caller can supply a value such as ".." to redirect the computed directory outside the intended /tmp/<name>/<id> path. A deferred cleanup function that calls os.RemoveAll on that directory then runs unconditionally when the HTTP handler returns, deleting whatever directory the traversal resolved to. With dagRunId set to "..", the resolved directory is the system temporary directory (/tmp on Linux). On non-root deployments, os.RemoveAll("/tmp") removes all files in /tmp owned by the dagu process user, disrupting every concurrent dagu run that has live temp files. On root or Docker deployments, the call removes the entire contents of /tmp, causing a system-wide denial of service. This vulnerability is fixed in 2.2.4.
Weakness: CWE-22
Which versions are affected by CVE-2026-31886?
3 open source packages ship an affected version, including github.com/dagu-org/dagu. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/dagu-org/dagu Go | All versions | None |
github.com/dagu-org/dagu Go | All versions to 2.2.4 | None |
github.com/dagu-org/dagu Go | All versions to 2.2.4 | None |
Products include Dagu Dagu.
How do I fix CVE-2026-31886?
Upgrade to a fixed version.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-31886 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-31886 exists.
Other vulnerabilities in dagu-org dagu
Sources
Also known as GHSA-m4q3-457p-hh2x, GO-2026-4693.