Advisories for Golang/Github.com/Dagu-Org/Dagu package

The CreateNewDAG API endpoint (POST /api/v1/dags) does not validate the DAG name before passing it to the file store. While RenameDAG calls core.ValidateDAGName() to reject names containing path separators (line 273 in dags.go), CreateNewDAG skips this validation entirely and passes user input directly to dagStore.Create(). In internal/persis/filedag/store.go, the generateFilePath function (line 493) checks if the name contains a path separator, and if so, resolves it via filepath.Abs(name) — completely ignoring …

Dagu's default configuration ships with authentication disabled. The POST /api/v2/dag-runs endpoint accepts an inline YAML spec and executes its shell commands immediately with no credentials required — any dagu instance reachable over the network is fully compromised by default.