CVE-2026-33344 Dagu has an incomplete fix for CVE-2026-27598: path traversal via %2F-encoded slashes in locateDAG

What is CVE-2026-33344?

CVE-2026-33344 is a high-severity path traversal vulnerability in dagu-org dagu, published on 24 Mar 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Dagu is a workflow engine with a built-in Web user interface. From version 2.0.0 to before version 2.3.1, the fix for CVE-2026-27598 added ValidateDAGName to CreateNewDAG and rewrote generateFilePath to use filepath.Base. This patched the CREATE path. The remaining API endpoints - GET, DELETE, RENAME, EXECUTE - all pass the {fileName} URL path parameter to locateDAG without calling ValidateDAGName. %2F-encoded forward slashes in the {fileName} segment traverse outside the DAGs directory. This issue has been patched in version 2.3.1.

Weakness: CWE-22

Which versions are affected by CVE-2026-33344?

3 open source packages ship an affected version, including github.com/dagu-org/dagu. It affects 1 product.

Products include Dagu Dagu.

How do I fix CVE-2026-33344?

Upgrade github.com/dagu-org/dagu to 1.30.4-0.20260319093346-7d07fda8f9de or later.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2026-33344 being exploited?

There is no known exploitation of CVE-2026-33344 in the wild and no public exploit code.

Other vulnerabilities in dagu-org dagu

• CVE-2026-31886 Dagu has a Path Traversal via `dagRunId` in Inline DAG Execution Critical 9.1
• CVE-2026-31882 Dagu SSE Authentication Bypass in Basic Auth Mode High 7.5
• CVE-2026-27598 Dagu: Path traversal in DAG creation allows arbitrary YAML file write outside DAGs directory High 7.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-ph8x-4jfv-v9v8, GO-2026-4785.