CVE-2026-31886 - Vulnerability Analysis

Overview

Dagu < 2.2.4 contains a path traversal caused by lack of validation on dagRunId in inline DAG execution endpoints, letting attackers delete arbitrary directories including /tmp, exploit requires crafted dagRunId input.

Severity & Score

Impact

Attackers can delete arbitrary files/directories, causing denial of service and disruption of concurrent runs or entire system.

Mitigation

Update to version 2.2.4 or later.

References

• https://github.com/dagu-org/dagu/commit/12c2e5395bd9331d49ca103593edfd0db39c4f38
• https://github.com/dagu-org/dagu/security/advisories/GHSA-m4q3-457p-hh2x

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 14, 2026

🔴 CVE-2026-31886 - Critical (9.1) Dagu is a workflow engine with a built-in Web user interface. Prior to 2.2.4, the dagRunId request field accepted by the inline DAG execution endpoints is passed directly into filepath.Join to construct a temporary directory path without any forma... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-31886/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner