CVE-2026-27598
Description
Dagu is a workflow engine with a built-in Web user interface. In versions up to and including 1.16.7, the CreateNewDAG API endpoint (POST /api/v1/dags) does not validate the DAG name before passing it to the file store. An authenticated user with DAG write permissions can write arbitrary YAML files anywhere on the filesystem (limited by the process permissions). Since dagu executes DAG files as shell commands, writing a malicious DAG to the DAGs directory of another instance or overwriting config files can lead to remote code execution. Commit e2ed589105d79273e4e6ac8eb31525f765bb3ce4 fixes the issue.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/dagu-org/daguGo | <= 1.16.7 | — |
Affected products
5- ghsa-coords3 versionspkg:golang/github.com/dagu-org/dagupkg:rpm/opensuse/govulncheck-vulndb&distro=openSUSE%20Leap%2015.6pkg:rpm/opensuse/govulncheck-vulndb&distro=openSUSE%20Leap%2016.0
<= 1.16.7+ 2 more
- (no CPE)range: <= 1.16.7
- (no CPE)range: < 0.0.20260226T182644-150000.1.149.1
- (no CPE)range: < 0.0.20260723T184607-160000.1.1
Patches
Vulnerability mechanics
References
5- github.com/dagu-org/dagu/commit/e2ed589105d79273e4e6ac8eb31525f765bb3ce4nvdPatchWEB
- github.com/dagu-org/dagu/security/advisories/GHSA-6v48-fcq6-ff23nvdExploitVendor AdvisoryWEB
- github.com/advisories/GHSA-6v48-fcq6-ff23ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-27598ghsaADVISORY
- pkg.go.dev/vuln/GO-2026-4542ghsaWEB
News mentions
0No linked articles in our index yet.