CVE-2026-102943

Name of the Vulnerable Software and Affected Versions Dagu versions prior to 2.11.0

Description The dagu read operation with target dag spec invokes the DAG specification API directly, bypassing the HTTP middleware. Because the underlying resolver does not restrict resolved paths to configured DAG directories, an authenticated attacker with a viewer-role API key can use absolute or traversing paths to read .yaml or .yml files outside the intended directories that are accessible to the Dagu process. This issue allows for unauthorized file reading but does not provide write or execution capabilities.

Recommendations Update Dagu to version 2.11.0.