CVE-2026-33344 - Vulnerability Analysis

Overview

Dagu 2.0.0 to < 2.3.1 contains a path traversal caused by improper validation of {fileName} URL path parameter in API endpoints, letting attackers access files outside DAGs directory, exploit requires crafted URL with encoded slashes.

Severity & Score

Impact

Attackers can access files outside the intended directory, potentially exposing sensitive data or system files.

Mitigation

Update to version 2.3.1 or later.

References

• https://github.com/dagu-org/dagu/commit/7d07fda8f9de3ae73dfb081ccd0639f8059c56bb
• https://github.com/dagu-org/dagu/security/advisories/GHSA-ph8x-4jfv-v9v8

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 24, 2026

🟠 CVE-2026-33344 - High (8.1) Dagu is a workflow engine with a built-in Web user interface. From version 2.0.0 to before version 2.3.1, the fix for CVE-2026-27598 added ValidateDAGName to CreateNewDAG and rewrote generateFilePath to use filepath.Base. This patched the CREATE p... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33344/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner