A path traversal vulnerability in the Dagu workflow engine allows authenticated users to access unauthorized files on the underlying system, posing a significant risk to data confidentiality and integrity.

This is a path traversal vulnerability (CWE-22) occurring because several API endpoints (GET, DELETE, RENAME, EXECUTE) fail to validate the {fileName} parameter. An attacker with low privileges can use URL-encoded forward slashes (%2F) to escape the intended directory and access arbitrary files on the server.

The ability to traverse directories outside the intended scope allows an attacker to read sensitive configuration files or delete critical system data. With a CVSS score of 8.1, this vulnerability is considered High severity because it permits unauthorized system interaction and potential information disclosure, which could lead to a complete compromise of the workflow engine environment.

Immediate Action: Update the Dagu workflow engine to version 2.3.1 or later to ensure all API endpoints correctly validate the {fileName} parameter.

Proactive Monitoring: Review web server access logs for requests containing URL-encoded characters such as %2F or sequences attempting to navigate parent directories (e.g., ../).

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to block requests containing path traversal sequences or double-encoded characters targeting the Dagu API endpoints.

Public Exploit Available: exploit_available (unknown)

This vulnerability represents a significant security oversight in the Dagu API handling process. Organizations utilizing the Dagu workflow engine should prioritize upgrading to version 2.3.1 immediately to close the path traversal vector. Until patching is completed, ensure that the Dagu web interface is restricted to trusted networks only to limit the exposure of the vulnerable API endpoints to potentially malicious authenticated users.