ZeroDay Findings
Sign inSign up

Findings

CVE-2026-27598

Dagu is a workflow engine with a built-in Web user interface.

Published Feb 25, 2026 · updated Jun 17, 2026 · dagu dagu

Dagu is a workflow engine with a built-in Web user interface. In versions up to and including 1.16.7, the API endpoint ( ) does not validate the DAG name before passing it to the file store. An authenticated user with DAG write permissions can write arbitrary YAML files anywhere on the filesystem (limited by the process permissions). Since dagu executes DAG files as shell commands, writing a malicious DAG to the DAGs directory of another instance or overwriting config files can lead to remote code execution. Commit e2ed589105d79273e4e6ac8eb31525f765bb3ce4 fixes the issue.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Feb 25, 2026 · NIST NVD

    Detected

    Dagu is a workflow engine with a built-in Web user interface. In versions up to and including 1.16.7, the API endpoint ( ) does not validate the DAG name before passing it to the file store. An authenticated user with DAG write permissions can write arbitrary YAML files anywhere on the filesystem (limited by the process permissions). Since dagu executes DAG files as shell commands, writing a malic

  2. Jun 17, 2026 · NIST NVD

    Updated

    Dagu is a workflow engine with a built-in Web user interface. In versions up to and including 1.16.7, the API endpoint ( ) does not validate the DAG name before passing it to the file store. An authenticated user with DAG write permissions can write arbitrary YAML files anywhere on the filesystem (limited by the process permissions). Since dagu executes DAG files as shell commands, writing a malic

Affected

  • cpe dagu/daguversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2026-27598

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-27598

    Dagu is a workflow engine with a built-in Web user interface. In versions up to and including 1.16.7, the API endpoint ( ) does not validate the DAG name before passing it to the file store. An authenticated user with DAG write permissions can wri

    nvd.nist.gov

References