CVE-2026-31886

Dagu is a workflow engine with a built-in Web user interface. Prior to 2.2.4, the dagRunId request field accepted by the inline DAG execution endpoints is passed directly into filepath.Join to construct a temporary directory path without any format validation. Go's filepath.Join resolves .. segments lexically, so a caller can supply a value such as ".." to redirect the computed directory outside the intended /tmp/<name>/<id> path. A deferred cleanup function that calls os.RemoveAll on that directory then runs unconditionally when the HTTP handler returns, deleting whatever directory the traversal resolved to. With dagRunId set to "..", the resolved directory is the system temporary directory (/tmp on Linux). On non-root deployments, os.RemoveAll("/tmp") removes all files in /tmp owned by the dagu process user, disrupting every concurrent dagu run that has live temp files. On root or Docker deployments, the call removes the entire contents of /tmp, causing a system-wide denial of service. This vulnerability is fixed in 2.2.4.

• CWE-22

• https://github.com/dagu-org/dagu/commit/12c2e5395bd9331d49ca103593edfd0db39c4f38Patch
• https://github.com/dagu-org/dagu/security/advisories/GHSA-m4q3-457p-hh2xExploit, Mitigation, Vendor Advisory

Published

Mar 13, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-3188A security flaw has been discovered in feiyuchuixue sz-boot-…4.3
• CVE-2026-31881Runtipi is a personal homeserver orchestrator. Prior to 4.8.…9.8
• CVE-2026-31882Dagu is a workflow engine with a built-in Web user interface…7.5
• CVE-2026-31883FreeRDP is a free implementation of the Remote Desktop Proto…9.8
• CVE-2026-31884FreeRDP is a free implementation of the Remote Desktop Proto…7.5
• CVE-2026-31885FreeRDP is a free implementation of the Remote Desktop Proto…9.4
• CVE-2026-31887Shopware is an open commerce platform. Prior to 6.7.8.1 and …7.5
• CVE-2026-31888Shopware is an open commerce platform. Prior to 6.7.8.1 and …5.3
• CVE-2026-31889Shopware is an open commerce platform. Prior to 6.6.10.15 an…8.9
• CVE-2026-3189A weakness has been identified in feiyuchuixue sz-boot-paren…3.1
• CVE-2026-31890Inspektor Gadget is a set of tools and framework for data co…5.5
• CVE-2026-31891Cockpit is a headless content management system. Any Cockpit…6.5