Dagu hat eine unvollständige Behebung für CVE-2026-27598: Pfadtraversierung über %2F-kodierte Schrägstriche in locateDAG

This Path Traversal vulnerability arises from insufficient validation of the {fileName} parameter in several Dagu API endpoints (GET, DELETE, RENAME, EXECUTE). An attacker can leverage encoded forward slashes (%2F) within this parameter to traverse outside the designated DAGs directory. Successful exploitation could grant unauthorized access to arbitrary files on the server's file system, potentially exposing sensitive configuration data, credentials, or other critical information. The impact is amplified if the server is used to manage sensitive data or control critical infrastructure, as an attacker could gain a foothold for further malicious activities, including code execution or data exfiltration. While no direct exploitation has been publicly reported, the ease of exploitation and potential impact make this a significant security concern.

Organizations utilizing Dagu for DAG management, particularly those with publicly exposed API endpoints, are at risk. Environments with legacy Dagu configurations or those lacking robust network segmentation are especially vulnerable. Shared hosting environments where multiple users share a Dagu instance also face increased risk.

• linux / server:

journalctl -u dagu -g "locateDAG" | grep -i '%2F'

• generic web:

curl -I 'http://your-dagu-instance/api/dag/your-dag-name/%2e%2e%2f/etc/passwd' | grep 'HTTP/1.1 403' # Expect 403 Forbidden after patching

1. 2026-03-19Disclosure

   disclosure

1. Reserviert2026-03-18
2. Veröffentlicht2026-03-19
3. Geändert2026-03-27
4. EPSS aktualisiert2026-04-01

The primary mitigation for CVE-2026-33344 is to immediately upgrade Dagu to version 1.30.4-0.20260319093346-7d07fda8f9de or later. If upgrading is not immediately feasible, consider implementing temporary workarounds such as restricting network access to the vulnerable API endpoints or employing a Web Application Firewall (WAF) to filter requests containing encoded forward slashes in the {fileName} parameter. Carefully review and harden the Dagu configuration to minimize the potential impact of a successful attack. After upgrading, confirm the fix by attempting to access files outside the DAGs directory using crafted requests with encoded forward slashes; access should be denied.