CVE-2026-33344 Scanner
CVE-2026-33344 Scanner - Path Traversal vulnerability in dagu
Used 3 times · 4.2k assets checked · domain, subdomain, ipv4
CVE
CVE-2026-33344
8.1
CVSShigh
Exploitable remotely over the internet · low-privilege account sufficient.
Description
Dagu is a workflow engine with a built-in Web user interface. From version 2.0.0 to before version 2.3.1, the fix for CVE-2026-27598 added ValidateDAGName to CreateNewDAG and rewrote generateFilePath to use filepath.Base. This patched the CREATE path. The remaining API endpoints - GET, DELETE, RENAME, EXECUTE - all pass the {fileName} URL path parameter to locateDAG without calling ValidateDAGName. %2F-encoded forward slashes in the {fileName} segment traverse outside the DAGs directory. This issue has been patched in version 2.3.1.
Attack Vector
Network
Privileges Req.
Low
User Interaction
None
dagu
Updated Nov 13, 2026View on NVD →
S4E scanner
CVE history: dagu
Predict next CVE date with AIMonitor this CVE on your assets
S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.
Create a free account →