CVE-2026-27598

Dagu is a workflow engine with a built-in Web user interface. In versions up to and including 1.16.7, the "CreateNewDAG" API endpoint "POST /api/v1/dags" does not validate the DAG name before passing it to the file store. An authenticated user with DAG write permissions can write arbitrary YAML...