Description

Dagu is a workflow engine with a built-in Web user interface. In versions up to and including 1.16.7, the `CreateNewDAG` API endpoint (`POST /api/v1/dags`) does not validate the DAG name before passing it to the file store. An authenticated user with DAG write permissions can write arbitrary YAML files anywhere on the filesystem (limited by the process permissions). Since dagu executes DAG files as shell commands, writing a malicious DAG to the DAGs directory of another instance or overwriting config files can lead to remote code execution. Commit e2ed589105d79273e4e6ac8eb31525f765bb3ce4 fixes the issue.

INFO

Published Date :

2026-02-25T00:27:40.654Z

Last Modified :

2026-02-26T21:02:19.359Z

Source :

GitHub_M
AFFECTED PRODUCTS

The following products are affected by CVE-2026-27598 vulnerability.

Vendors Products
Dagu
  • Dagu
Dagu-org
  • Dagu
REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2026-27598.

URL Resource
https://github.com/dagu-org/dagu/commit/e2ed589105d79273e4e6ac8eb31525f765bb3ce4 cve-icon cve-icon
https://github.com/dagu-org/dagu/security/advisories/GHSA-6v48-fcq6-ff23 cve-icon cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Attack Requirements
Privileges Required
User Interaction
VS Confidentiality
VS Integrity
VS Availability
SS Confidentiality
SS Integrity
SS Availability
Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact