PT-2026-23658 · Windmill · Windmill

Chocapikk · Published 2026-03-06 · Updated 2026-04-07 · CVE-2026-29059

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Windmill versions prior to 1.603.3

Description Windmill is an open-source developer platform for internal code, including APIs, background jobs, workflows, and UIs. A path traversal vulnerability exists in the get log file endpoint ('/api/w/{workspace}/jobs u/get log file/{filename}') prior to version 1.603.3. The filename parameter is improperly concatenated into a file path without sufficient sanitization, potentially allowing an attacker to read arbitrary files on the server using '..' sequences. This could lead to the exposure of sensitive information, including the SUPERADMIN SECRET in some cases. Exploitation requires no authentication.

Recommendations Update Windmill to version 1.603.3 or later.

Exploit

Fix

RCE

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-29059

GHSA-24FR-44F8-FQWG

Affected Products

Windmill

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29059.json · Exploit
• 🔥 https://github.com/Chocapikk/Windfall · Exploit
• https://github.com/windmill-labs/windmill/security/advisories/GHSA-24fr-44f8-fqwg · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-29059 · Security Note
• https://osv.dev/vulnerability/CVE-2026-29059 · Vendor Advisory
• https://github.com/windmill-labs/windmill/releases/tag/v1.603.3 · Note
• https://t.me/cveNotify/154474 · Telegram Post
• https://reddit.com/r/hetzner/comments/1rqm4w5/storage_share_security_concerns · Reddit Post
• https://twitter.com/CVEnew/status/2029975547212959979 · Twitter Post
• https://twitter.com/Chocapikk_/status/2041466752433840305 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2029902056715087927 · Twitter Post
• https://t.me/CVEtracker/46562 · Telegram Post