Full Report
A high-severity security flaw impacting open-source developer platform Windmill has come under active exploitation in the wild, per VulnCheck. The vulnerability in question is CVE-2026-29059 (CVSS score: 7.5), a case of unauthenticated path traversal impacting Windmill's "get_log_file" endpoint ("/api/w/{workspace}/jobs_u/get_log_file/{filename}"). "The filename parameter is concatenated into
Analysis Summary
# Vulnerability: Path Traversal in Windmill "get_log_file" Endpoint
## CVE Details
- **CVE ID:** CVE-2026-29059
- **CVSS Score:** 7.5 (High)
- **CWE:** CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
## Affected Systems
- **Products:** Windmill (Open-source developer platform)
- **Versions:** All versions prior to the patched release (Check vendor repository for specific build numbers)
- **Configurations:** Systems exposing the Windmill API to the internet or untrusted networks are at highest risk.
## Vulnerability Description
The vulnerability exists in the `get_log_file` endpoint located at `/api/w/{workspace}/jobs_u/get_log_file/{filename}`. The flaw is an unauthenticated path traversal vulnerability. The `filename` parameter is concatenated directly into a file path string without adequate sanitization or validation. This allows an attacker to use "dot-dot-slash" (`../`) sequences to escape the intended log directory and access sensitive files on the underlying host operating system that the application process has permissions to read.
## Exploitation
- **Status:** **Exploited in the wild** (Reported by VulnCheck)
- **Complexity:** Low
- **Attack Vector:** Network (Unauthenticated)
## Impact
- **Confidentiality:** High (Potential access to system configuration files, credentials, and sensitive application data)
- **Integrity:** None (Read-only vulnerability)
- **Availability:** None
## Remediation
### Patches
- Users should update Windmill to the latest available version immediately. Consult the official Windmill GitHub repository or deployment documentation for the most recent security release.
### Workarounds
- Restrict access to the Windmill API using a Web Application Firewall (WAF) to block requests containing path traversal sequences (e.g., `../`, `%2e%2e%2f`).
- Place the Windmill instance behind a VPN or firewall to limit exposure to trusted IP addresses only.
## Detection
- **Indicators of Compromise:**
- Web server logs showing `GET` requests to `/api/w/*/jobs_u/get_log_file/` containing `../` or encoded equivalents.
- Unusual access patterns to system files (e.g., `/etc/passwd`, `.env` files) originating from the Windmill service account.
- **Detection methods:** Review application access logs for the specific endpoint mentioned above. Use SIEM rules to flag directory traversal attempts in URI paths.
## References
- **VulnCheck Advisory:** hxxps[://]vulncheck[.]com/advisories/cve-2026-29059
- **Windmill Official Site:** hxxps[://]windmill[.]dev/
- **NVD Entry:** hxxps[://]nvd[.]nist[.]gov/vuln/detail/CVE-2026-29059 (Note: Standardized placeholder for future registry)