Unauthenticated path traversal in Windmill get_log_file endpoint
Windmill path traversal (CVE-2026-29059) lets unauthenticated attackers read arbitrary server files. CVSS 7.5 high. Active exploitation confirmed by VulnCheck, July 2026.
- Vendor
- Windmill Labs
- Product
- Windmill
- CVSS
- 7.5
- EPSS (exploit probability)
- 3.1%
- Status
- exploited-in-wild
- Published
Is CVE-2026-29059 being exploited?
Exploitation has been reported (sources in the write-up below), but CVE-2026-29059 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-11-13 snapshot.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 3.1% (scored November 1, 2026).
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-11-13. Full cross-catalog view: /kev-comparison
CVE-2026-29059 timeline
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
An unauthenticated path traversal vulnerability in the open-source developer workflow platform Windmill allows remote attackers to read arbitrary server-side files without any credentials.
Affected component: The get_log_file API endpoint (/api/w/{workspace}/jobs_u/get_log_file/{filename}). The filename parameter is concatenated into a filesystem path without sanitization, enabling directory traversal by an unauthenticated caller.
Impact: Remote, unauthenticated file read. Depending on deployment configuration, accessible content may include job logs, configuration files, and secrets stored in locations accessible to the Windmill process user.
Exploitation status: Active in-the-wild exploitation confirmed by VulnCheck as of July 22, 2026. Not yet listed on CISA’s Known Exploited Vulnerabilities catalog at time of publication.
Patch: Available in Windmill’s GitHub releases. Apply immediately. If patching is not immediately possible, restrict network access to the instance and audit filesystem exposure.
Sources: NVD | VulnCheck via The Hacker News
