PT-2026-23658 · Windmill · Windmill

Chocapikk · Published 2026-03-06 · Updated 2026-04-07 · CVE-2026-29059

Positive Technologies · (AI Summary)

CVSS v4.0

6.9

Medium

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Windmill versions prior to 1.603.3

Description Windmill is a developer platform for internal code, including APIs, background jobs, workflows, and UIs. A path traversal vulnerability exists in the get log file API endpoint ('/api/w/{workspace}/jobs u/get log file/{filename}') prior to version 1.603.3. The filename parameter is improperly concatenated into a file path without sufficient sanitization. This allows an attacker to read arbitrary files on the server by utilizing '../' sequences. Exploitation does not require authentication. The vulnerability allows access to sensitive information, including potential credential leaks and root shell access.

Recommendations Update Windmill to version 1.603.3 or later.

Exploit

Fix

RCE

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-29059

GHSA-24FR-44F8-FQWG

Affected Products

Windmill

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29059.json · Exploit
• 🔥 https://github.com/Chocapikk/Windfall · Exploit
• https://osv.dev/vulnerability/CVE-2026-29059 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-29059 · Security Note
• https://github.com/windmill-labs/windmill/releases/tag/v1.603.3 · Note
• https://github.com/windmill-labs/windmill/security/advisories/GHSA-24fr-44f8-fqwg · Note
• https://twitter.com/VulmonFeeds/status/2029902056715087927 · Twitter Post
• https://t.me/cveNotify/154474 · Telegram Post
• https://twitter.com/CVEnew/status/2029975547212959979 · Twitter Post
• https://t.me/CVEtracker/46562 · Telegram Post
• https://twitter.com/Chocapikk_/status/2041466752433840305 · Twitter Post
• https://reddit.com/r/hetzner/comments/1rqm4w5/storage_share_security_concerns · Reddit Post