CVE-2026-31886 Overview
CVE-2026-31886 is a path traversal vulnerability affecting Dagu, a workflow engine with a built-in web user interface. Prior to version 2.2.4, the dagRunId request field accepted by inline DAG execution endpoints is passed directly into filepath.Join to construct a temporary directory path without any format validation. This allows attackers to manipulate the path and cause system-wide denial of service through arbitrary directory deletion.
Critical Impact
Authenticated attackers can leverage this path traversal to delete the entire contents of /tmp on Linux systems, causing system-wide denial of service affecting all concurrent Dagu runs and potentially other system processes.
Affected Products
- Dagu versions prior to 2.2.4
- Docker deployments running Dagu as root
- Linux-based Dagu installations with default /tmp configuration
Discovery Timeline
- 2026-03-13 - CVE-2026-31886 published to NVD
- 2026-03-18 - Last updated in NVD database
Technical Details for CVE-2026-31886
Vulnerability Analysis
This vulnerability stems from insufficient input validation in Dagu's inline DAG execution endpoints. The dagRunId request field is used to construct temporary directory paths via Go's filepath.Join function. Since filepath.Join resolves .. segments lexically, an attacker can supply path traversal sequences to redirect the computed directory outside the intended /tmp/<name>/<id> path structure.
The critical issue is that a deferred cleanup function calls os.RemoveAll on the resolved directory path unconditionally when the HTTP handler returns. When an attacker sets dagRunId to .., the resolved directory becomes the system temporary directory (/tmp on Linux), resulting in deletion of all accessible files in that directory.
The impact varies based on deployment configuration:
- Non-root deployments: os.RemoveAll("/tmp") removes all files owned by the dagu process user, disrupting concurrent dagu runs with active temp files
- Root or Docker deployments: The call removes the entire contents of /tmp, causing system-wide denial of service
Root Cause
The root cause is a classic CWE-22 (Path Traversal) vulnerability where user-controlled input is passed directly to filesystem operations without proper sanitization. The filepath.Join function in Go does not prevent directory traversal sequences—it merely resolves them lexically. Combined with the unconditional os.RemoveAll cleanup operation, this creates a dangerous primitive for arbitrary directory deletion.
Attack Vector
The attack vector is network-based and requires low-privileged authenticated access to the Dagu web interface. An attacker crafts a malicious request to the inline DAG execution endpoint with a dagRunId value containing path traversal sequences such as ... When the handler completes and the deferred cleanup function executes, the system temporary directory is deleted instead of the intended run-specific directory.
The vulnerability mechanism involves the following flow:
- Attacker sends request to inline DAG execution endpoint with dagRunId set to ..
- Server constructs path using filepath.Join(baseDir, dagRunId) which resolves to parent directory
- DAG execution proceeds normally
- Deferred cleanup calls os.RemoveAll on the traversed path
- System /tmp directory contents are deleted
The security patch modifies the reference path handling to properly validate input. See the GitHub Commit for the complete fix.
}
// Seed built-in knowledge references to data dir (not git-synced).
- fileagentskill.SeedReferences(
+ referencesDir := fileagentskill.SeedReferences(
filepath.Join(cfg.Paths.DataDir, "agent", "references"),
)
Source: GitHub Commit Details
Detection Methods for CVE-2026-31886
Indicators of Compromise
- HTTP requests to inline DAG execution endpoints containing .. sequences in the dagRunId parameter
- Unexpected deletion of files within /tmp directory
- Dagu workflow failures due to missing temporary files
- System logs showing os.RemoveAll operations on unexpected paths
Detection Strategies
- Monitor web application logs for requests containing path traversal patterns (.., %2e%2e, etc.) in DAG-related endpoints
- Implement file integrity monitoring on the /tmp directory to detect unexpected mass deletions
- Review access logs for authenticated users making unusual requests to inline DAG execution endpoints
- Deploy web application firewall rules to block path traversal sequences in request parameters
Monitoring Recommendations
- Enable verbose logging for Dagu to capture all incoming request parameters
- Configure alerting for sudden decreases in /tmp directory file counts
- Monitor for Dagu service disruptions or workflow execution failures that may indicate exploitation
- Track authentication events to identify potential malicious actors targeting the vulnerability
How to Mitigate CVE-2026-31886
Immediate Actions Required
- Upgrade Dagu to version 2.2.4 or later immediately
- Review access controls to limit who can access inline DAG execution endpoints
- Avoid running Dagu as root or with elevated privileges
- Implement network segmentation to restrict access to the Dagu web interface
Patch Information
The vulnerability is fixed in Dagu version 2.2.4. The patch introduces proper validation of the dagRunId parameter to prevent path traversal sequences from escaping the intended temporary directory structure.
For complete technical details, refer to the GitHub Security Advisory and the patch commit.
Workarounds
- Run Dagu with a dedicated non-root user to limit the impact of potential exploitation to user-owned files
- Implement a reverse proxy with input validation to filter path traversal patterns before they reach Dagu
- Use container isolation with read-only /tmp mounts or separate tmpfs volumes per workflow
- Apply network-level access controls to restrict access to the Dagu web interface to trusted networks only
# Configuration example - Run Dagu as non-root user
# Create dedicated user for Dagu
useradd -r -s /bin/false dagu-service
# Set ownership of Dagu directories
chown -R dagu-service:dagu-service /opt/dagu
# Run Dagu as the dedicated user
su -s /bin/bash -c '/opt/dagu/bin/dagu server' dagu-service
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
