An authenticated user with DAG write permissions can specify arbitrary DAG names, allowing the CreateNewDAG endpoint to write YAML files anywhere on the filesystem within the process's permissions. This path traversal flaw permits writing malicious DAG files that, once executed, can run arbitrary shell commands. In addition, an attacker could overwrite the DAGs of another instance or modify configuration files, leading to remote code execution.

The vulnerability affects the dagu workflow engine provided by dagu-org. Versions up to and including 1.16.7 are impacted. The flaw resides in the API endpoint that creates new DAGs. The underlying file system permissions of the instance determine how far the attacker can write files.

The CVSS base score of 7.1 indicates high-risk severity, while an EPSS value of less than 1% reflects a very low likelihood of exploitation currently. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires authentication to the API with DAG write rights and depends on the file system privileges granted to the dagu process. Once the attacker writes a malicious YAML file, execution of that file through the engine can lead to arbitrary code execution on the host.