CRITICAL9.8Go
GHSA-6qr9-g2xw-cw92· GO-2026-4527Dagu affected by unauthenticated RCE via inline DAG spec in default configuration
Modified: 2/23/2026
package
Go/github.com/dagu-org/dagu
pkg:go/github.com/dagu-org/dagu
HIGHGo
GHSA-6v48-fcq6-ff23· CVE-2026-27598, GO-2026-4542Dagu: Path traversal in DAG creation allows arbitrary YAML file write outside DAGs directory
Modified: 2/28/2026
CRITICAL9.1Go
GHSA-m4q3-457p-hh2x· CVE-2026-31886, GO-2026-4693Dagu: Path Traversal via `dagRunId` in Inline DAG Execution
Modified: 3/23/2026
HIGH8.1Go
GHSA-ph8x-4jfv-v9v8· CVE-2026-33344, GO-2026-4785Dagu has an incomplete fix for CVE-2026-27598: path traversal via %2F-encoded slashes in locateDAG
Modified: 3/27/2026
—Go
GO-2026-4527· GHSA-6qr9-g2xw-cw92Dagu affected by unauthenticated RCE via inline DAG spec in default configuration in github.com/dagu-org/dagu
Modified: 2/23/2026
—Go
GO-2026-4542· CVE-2026-27598, GHSA-6v48-fcq6-ff23Dagu: Path traversal in DAG creation allows arbitrary YAML file write outside DAGs directory in github.com/dagu-org/dagu
Modified: 2/25/2026
—Go
GO-2026-4693· CVE-2026-31886, GHSA-m4q3-457p-hh2xDagu: Path Traversal via `dagRunId` in Inline DAG Execution in github.com/dagu-org/dagu
Modified: 3/23/2026
—Go
GO-2026-4785· CVE-2026-33344, GHSA-ph8x-4jfv-v9v8Dagu has an incomplete fix for CVE-2026-27598: path traversal via %2F-encoded slashes in locateDAG in github.com/dagu-org/dagu
Modified: 3/23/2026