{"answers":{"affected":"3 open source packages ship an affected version, including github.com/dagu-org/dagu. It affects 1 product.","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-31886 exists.","fix":"Upgrade to a fixed version.","what":"CVE-2026-31886 is a critical path traversal vulnerability in dagu-org dagu, published on 13 Mar 2026. Any signed-in user can exploit it over the network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-31886 and fix it if it is affected.\n\nWhat it is: CVE-2026-31886 is a critical path traversal vulnerability in dagu-org dagu, published on 13 Mar 2026. Any signed-in user can exploit it over the network, with no action from the victim.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-31886 exists.\n\nAffected packages and fixed versions:\n- github.com/dagu-org/dagu (Go): affected all versions; no fix listed\n- github.com/dagu-org/dagu (Go): affected all versions up to 2.2.4; no fix listed\n- github.com/dagu-org/dagu (Go): affected all versions up to 2.2.4; no fix listed\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-31886/ (Markdown: https://insights.sbomify.com/CVE-2026-31886/index.md)","id":"CVE-2026-31886","markdown":"https://insights.sbomify.com/CVE-2026-31886/index.md","name":"CVE-2026-31886","record":{"aliases":["GHSA-m4q3-457p-hh2x","GO-2026-4693"],"analysis":{"component_type":"server_software","fix_type":"upgrade","impacts":["denial_of_service"],"network_reachable":"yes","non_default_config":false,"product_category":"Dagu workflow engine","requires_auth":"low_privilege","summary":"Attackers can delete system temporary files via path traversal in Dagu, causing denial of service for concurrent runs or the entire system.","user_interaction":"not_required","vuln_class":"path_traversal"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[{"product":"dagu","vendor":"dagu"}],"cvss":{"score":9.1,"severity":"critical","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H","version":"3.1"},"cwes":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory"}],"description":"Dagu is a workflow engine with a built-in Web user interface. Prior to 2.2.4, the dagRunId request field accepted by the inline DAG execution endpoints is passed directly into filepath.Join to construct a temporary directory path without any format validation. Go's filepath.Join resolves .. segments lexically, so a caller can supply a value such as \"..\" to redirect the computed directory outside the intended /tmp/\u003cname\u003e/\u003cid\u003e path. A deferred cleanup function that calls os.RemoveAll on that directory then runs unconditionally when the HTTP handler returns, deleting whatever directory the traversal resolved to. With dagRunId set to \"..\", the resolved directory is the system temporary directory (/tmp on Linux). On non-root deployments, os.RemoveAll(\"/tmp\") removes all files in /tmp owned by the dagu process user, disrupting every concurrent dagu run that has live temp files. On root or Docker deployments, the call removes the entire contents of /tmp, causing a system-wide denial of service. This vulnerability is fixed in 2.2.4.","ecosystems":["Go"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"weaponised"},"has_fix":true,"headline":"Dagu has a Path Traversal via `dagRunId` in Inline DAG Execution","id":"CVE-2026-31886","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Go","product":null,"products":[],"type":"path_traversal","year":"2026"},"n_packages":3,"n_references":2,"next":{"headline":"Shopware unauthenticated data extraction possible through store-api.order endpoint","id":"CVE-2026-31887"},"packages":[{"ecosystem":"Go","fixed":[],"introduced":["0"],"last_affected":[],"package":"github.com/dagu-org/dagu","purl":"pkg:golang/github.com/dagu-org/dagu","source":"GO-2026-4693"},{"ecosystem":"Go","fixed":[],"introduced":["0"],"last_affected":["2.2.4"],"package":"github.com/dagu-org/dagu","purl":null,"source":"GHSA-m4q3-457p-hh2x"},{"ecosystem":"Go","fixed":[],"introduced":["0"],"last_affected":["2.2.4"],"package":"github.com/dagu-org/dagu","purl":"pkg:golang/github.com/dagu-org/dagu","source":"GHSA-m4q3-457p-hh2x"}],"prev":{"headline":"FreeRDP has an out-of-bounds read in ADPCM decoders due to missing predictor/step_index bounds checks","id":"CVE-2026-31885"},"products":["dagu"],"published":"2026-03-13","related":[{"cvss_score":8.1,"headline":"Dagu has an incomplete fix for CVE-2026-27598: path traversal via %2F-encoded slashes in locateDAG","id":"CVE-2026-33344","kev_date_added":null,"published":"2026-03-24"},{"cvss_score":7.5,"headline":"Dagu SSE Authentication Bypass in Basic Auth Mode","id":"CVE-2026-31882","kev_date_added":null,"published":"2026-03-13"},{"cvss_score":7.1,"headline":"Dagu: Path traversal in DAG creation allows arbitrary YAML file write outside DAGs directory","id":"CVE-2026-27598","kev_date_added":null,"published":"2026-02-25"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CC BY 4.0","name":"Go Vulnerability Database","prefix":"GO"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"poc","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-03-13","vendors":["dagu-org"]},"summary":"Attackers can delete system temporary files via path traversal in Dagu, causing denial of service for concurrent runs or the entire system.","url":"https://insights.sbomify.com/CVE-2026-31886/"}