Publish GHSA-6v48-fcq6-ff23

Author: advisory-database[bot]

advisories/github-reviewed/2026/02/GHSA-6v48-fcq6-ff23/GHSA-6v48-fcq6-ff23.json

@@ -0,0 +1,61 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-6v48-fcq6-ff23",
+  "modified": "2026-02-24T21:43:15Z",
+  "published": "2026-02-24T21:43:15Z",
+  "aliases": [
+    "CVE-2026-27598"
+  ],
+  "summary": "Dagu: Path traversal in DAG creation allows arbitrary YAML file write outside DAGs directory",
+  "details": "The `CreateNewDAG` API endpoint (`POST /api/v1/dags`) does not validate the DAG name before passing it to the file store. While `RenameDAG` calls `core.ValidateDAGName()` to reject names containing path separators (line 273 in `dags.go`), `CreateNewDAG` skips this validation entirely and passes user input directly to `dagStore.Create()`.\n\nIn `internal/persis/filedag/store.go`, the `generateFilePath` function (line 493) checks if the name contains a path separator, and if so, resolves it via `filepath.Abs(name)` — completely ignoring the `baseDir`. This means a name like `../../tmp/pwned` will write a file to `/tmp/pwned.yaml` instead of the DAGs directory.\n\n**Affected code:**\n\n`internal/service/frontend/api/v1/dags.go` line 120-170 — `CreateNewDAG` handler, no call to `ValidateDAGName`\n\n`internal/persis/filedag/store.go` line 493-498 — `generateFilePath` resolves absolute path when name contains separator\n\n`internal/persis/filedag/store.go` line 213 — `Create` calls `generateFilePath` and writes attacker-controlled YAML content to the resolved path\n\n**PoC:**\n\n```\ncurl -X POST http://localhost:8080/api/v1/dags \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\n    \"name\": \"../../tmp/path-traversal-proof\",\n    \"spec\": \"steps:\\n  - command: id > /tmp/pwned\\n\"\n  }'\n```\n\nAfter this request, a file `/tmp/path-traversal-proof.yaml` will be created with the attacker-supplied content. The file will be written with the permissions of the dagu process.\n\nAn authenticated user with DAG write permissions can write arbitrary YAML files anywhere on the filesystem (limited by the process permissions). Since dagu executes DAG files as shell commands, writing a malicious DAG to the DAGs directory of another instance or overwriting config files can lead to remote code execution.",
+  "severity": [
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Go",
+        "name": "github.com/dagu-org/dagu"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "last_affected": "1.16.7"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/dagu-org/dagu/security/advisories/GHSA-6v48-fcq6-ff23"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/dagu-org/dagu/commit/e2ed589105d79273e4e6ac8eb31525f765bb3ce4"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/dagu-org/dagu"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-22"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": true,
+    "github_reviewed_at": "2026-02-24T21:43:15Z",
+    "nvd_published_at": null
+  }
+}