Threats tagged 'ghsa-5m6c-38r8-5w76'

A path traversal vulnerability exists in the Dagu MCP DAG specification read functionality (CVE-2026-102943) prior to version 2.11.0. The vulnerability arises because a traversal fix applied as HTTP middleware does not apply to in-process API calls made by the MCP service, allowing arbitrary YAML file reads with a viewer-role key. The flaw bypasses path containment and workspace isolation checks, enabling read-only access to .yaml/.yml files outside intended directories. The issue is confirmed at the HEAD commit after version 2.10.7 and fixed in version 2.11.0.