Unauthenticated path traversal in Windmill get_log_file endpoint
Windmill path traversal (CVE-2026-29059) lets unauthenticated attackers read arbitrary server files. CVSS 7.5 high. Active exploitation confirmed by VulnCheck, July 2026.
- Vendor
- Windmill Labs
- Product
- Windmill
- CVSS
- 7.5
- EPSS (exploit probability)
- N/A
- Status
- exploited-in-wild
- Published
An unauthenticated path traversal vulnerability in the open-source developer workflow platform Windmill allows remote attackers to read arbitrary server-side files without any credentials.
Affected component: The get_log_file API endpoint (/api/w/{workspace}/jobs_u/get_log_file/{filename}). The filename parameter is concatenated into a filesystem path without sanitization, enabling directory traversal by an unauthenticated caller.
Impact: Remote, unauthenticated file read. Depending on deployment configuration, accessible content may include job logs, configuration files, and secrets stored in locations accessible to the Windmill process user.
Exploitation status: Active in-the-wild exploitation confirmed by VulnCheck as of July 22, 2026. Not yet listed on CISA’s Known Exploited Vulnerabilities catalog at time of publication.
Patch: Available in Windmill’s GitHub releases. Apply immediately. If patching is not immediately possible, restrict network access to the instance and audit filesystem exposure.
Sources: NVD | VulnCheck via The Hacker News
