CVE-2026-33344

Dagu is a workflow engine with a built-in Web user interface. From version 2.0.0 to before version 2.3.1, the fix for CVE-2026-27598 added ValidateDAGName to CreateNewDAG and rewrote generateFilePath to use filepath.Base. This patched the CREATE path. The remaining API endpoints - GET, DELETE, RENAME, EXECUTE - all pass the {fileName} URL path parameter to locateDAG without calling ValidateDAGName. %2F-encoded forward slashes in the {fileName} segment traverse outside the DAGs directory. This issue has been patched in version 2.3.1.

• CWE-22

• https://github.com/dagu-org/dagu/commit/7d07fda8f9de3ae73dfb081ccd0639f8059c56bbPatch
• https://github.com/dagu-org/dagu/security/advisories/GHSA-ph8x-4jfv-v9v8Exploit, Mitigation, Vendor Advisory

Published

Mar 24, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-33335Vikunja is an open-source self-hosted task management platfo…8
• CVE-2026-33336Vikunja is an open-source self-hosted task management platfo…8.8
• CVE-2026-33337Firebird is an open-source relational database management sy…7.5
• CVE-2026-3334The CMS Commander plugin for WordPress is vulnerable to SQL …8.8
• CVE-2026-33340LoLLMs WEBUI provides the Web user interface for Lord of Lar…9.1
• CVE-2026-33343etcd is a distributed key-value store for the data of a dist…6.5
• CVE-2026-33345solidtime is an open-source time-tracking app. Prior to vers…6.5
• CVE-2026-33346OpenEMR is a free and open source electronic health records …8.7
• CVE-2026-33347league/commonmark is a PHP Markdown parser. From version 2.3…6.1
• CVE-2026-33348OpenEMR is a free and open source electronic health records …5.4
• CVE-2026-33349fast-xml-parser allows users to process XML from JS object w…5.9
• CVE-2026-3335The Canto plugin for WordPress is vulnerable to Missing Auth…5.3