Dagu is a workflow engine that uses a web UI to execute inline DAGs. Prior to version 2.2.4, the dagRunId request field is concatenated into a temporary directory path using filepath.Join without sanitization. Because Go’s filepath.Join treats .. segments lexically, a requester can supply a value such as ".." which causes the resolved directory to point outside the intended /tmp/<name>/<id> location. The code then runs a cleanup that calls os.RemoveAll on this directory, deleting whatever path was resolved. Consequently, a crafted request can delete arbitrary files or directories. When dagRunId is "..", the resulting path is the system temporary directory (/tmp on Linux). For non‑root deployments, this deletes all files in /tmp that belong to the dagu process user and disrupts concurrent runs. For root or container deployments, it removes the entire /tmp contents, leading to a system‑wide denial of service. The vulnerability is a classic CWE‑22 Path Traversal flaw and the impact is catastrophic file removal and availability loss.

The affected product is Dagu from vendor dagu-org. Versions prior to 2.2.4, as identified by the CPE cpe:2.3:a:dagu:dagu:*:*:*:*:*:*:*:* are vulnerable. The issue exists in the inline DAG execution endpoints of the web UI.

The CVSS score for this vulnerability is 9.1, indicating a high‑severity risk. The EPSS score is reported as less than 1%, suggesting a low likelihood of widespread exploitation at the moment, and the problem is not listed in the CISA KEV catalog. Attack conditions require the ability to send an HTTP request to the inline DAG execution endpoint with a crafted dagRunId value (e.g., ".."). The path traversal can be performed over the network if the Dagu UI is exposed, so remote attackers with network access to the service can potentially exploit it. Once exploited, the attacker can cause either localized trouble—deleting temporary files used by the dagu process on non‑privileged deployments—or a full system denial of service when running as root or within a Docker container. Inferred from the description, the primary vector is a remote HTTP request to an exposed endpoint, although the description does not state the exact exposure level.